CVE-2025-49438
BaseFortify
Publication date: 2025-08-20
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | simple_login_log | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-98 | The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. |
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Deserialization of Untrusted Data issue in the Simple Login Log software by Max Chirkov, which allows an attacker to perform Object Injection. This means that untrusted data can be deserialized in a way that enables malicious objects to be injected and executed within the application.
How can this vulnerability impact me? :
The vulnerability can have a high impact, potentially allowing an attacker to compromise confidentiality, integrity, and availability of the affected system. This could lead to unauthorized access, data manipulation, or denial of service.