Published At-16 Oct, 2025 | 18:15
Updated At-21 Oct, 2025 | 19:31
The file mexcel.php in the Vfront 0.99.52 codebase contains a vulnerable call to unserialize(base64_decode($_POST['mexcel'])), where $_POST['mexcel'] is user-controlled input. This input is decoded from base64 and deserialized without validation or use of the allowed_classes option, allowing an attacker to inject arbitrary PHP objects. This can lead to malicious behavior, such as Remote Code Execution (RCE), SQL Injection, Path Traversal, or Denial of Service, depending on the availability of exploitable classes in the Vfront codebase or its dependencies.
CISA Catalog
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|
| N/A | | |
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
| Type | Version | Base score | Base severity | Vector |
|---|
| Secondary | 3.1 | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Type: Secondary
Version: 3.1
Base score: 6.5
Base severity: MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
| CWE ID | Type | Source |
|---|
| CWE-89 | Secondary | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
Type: Secondary
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Change History
0Changes found