CVE-2025-66571

Vulnerability Description

UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed to PHP unserialize() without proper handling, allowing remote, unauthenticated attackers to inject arbitrary PHP objects and potentially write and execute arbitrary PHP code.

Vulnerability Details

Published Date

December 04, 2025

Last Modified

December 08, 2025

Source

NVD

CVE-2025-66571

Vulnerability Description

Vulnerability Details

Discussion (0)

Add Comment