Threats tagged 'ghsa-jc3r-732w-jg7c'

An unsafe deserialization vulnerability exists in MixPHP Framework versions 2.x through 2.2.17. The vulnerability arises because the sync-invoke client (specifically in Connection.php at line 76) uses PHP's unserialize() function on data received from the server response. This behavior allows a malicious server to send crafted data that can lead to remote code execution (RCE) on the client side.