BaseFortify

Publication date: 2025-12-18

Last updated on: 2025-12-19

Assigner: MITRE

Description

An insecure deserialization vulnerability exists in the download.php script of the to3k Twittodon application through commit b1c58a7d1dc664b38deb486ca290779621342c0b (2023-02-28). The 'obj' parameter receives base64-encoded data that is passed directly to the unserialize() function without validation. This allows a remote, unauthenticated attacker to inject arbitrary PHP objects, leading to a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-18

Last Modified

2025-12-19

Generated

2026-07-06

AI Q&A

2025-12-18

EPSS Evaluated

2026-07-05

NVD

CVE-2025-63950

Affected Vendors & Products

Vendor	Product	Version / Range
to3k	twittodon	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability is an insecure deserialization issue in the download.php script of the to3k Twittodon application. The 'obj' parameter accepts base64-encoded data that is directly passed to the PHP unserialize() function without any validation. This allows a remote, unauthenticated attacker to inject arbitrary PHP objects, potentially causing a denial of service. [2]

Impact Analysis

The vulnerability can allow a remote attacker to inject arbitrary PHP objects into the application, which can lead to a denial of service. This means the application could crash or become unavailable, disrupting service for users. [2]

Hi! I’m here to help you understand CVE-2025-63950. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70