CVE-2025-66571CWE-502insecure-deserialization

CVE-2025-66571

published December 5, 2025

CVSS
9.3
EPSS
1%
Percentile
48.7
In the wild
Unconfirmed
What it is

UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed to PHP unserialize() without proper handling, allowing remote, unauthenticated attackers to inject arbitrary PHP objects and potentially write and execute arbitrary PHP code.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00612 · 48.7th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2025-12-05T02:16Z
References (5)
https://github.com/unacms/una · [email protected]https://karmainsecurity.com/KIS-2025-01 · [email protected]https://unacms.com · [email protected]https://www.exploit-db.com/exploits/52139 · [email protected]https://www.vulncheck.com/advisories/una-cms-900-rc1-1400-rc4-php-object-injection · [email protected]
EPSS history
Timeline
  • 04 DEC 20:43Z
    UNA CMS 9.0.0-RC1 - 14.0.0-RC4 PHP Object Injection
    cvelistv5