CVE-2026-10721
Vulnerability Description
Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search components. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database. Thanks XananasX7 for reporting.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-502
Source
NVD
Vendor
Concrete CMS
Product
Concrete CMS
Discussion (0)
Add Comment
No comments yet. Be the first!