Threats tagged 'ghsa-xv9c-9hwm-jp8g'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.8	EPSS 1.0%	CVE-2026-91939Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties Critical9.8EPSS 1.0%2026-09-15GCVE DatabaseCVE-2026-91939 Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution. EPSS 1.0%Vulnerability CWE-502 #ghsa-xv9c-9hwm-jp8g	GCVE Database	2026-09-15

Page 1 of 1