BaseFortify

Publication date: 2025-12-04

Last updated on: 2025-12-08

Assigner: VulnCheck

Description

UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed to PHP unserialize() without proper handling, allowing remote, unauthenticated attackers to inject arbitrary PHP objects and potentially write and execute arbitrary PHP code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-04

Last Modified

2025-12-08

Generated

2026-07-06

AI Q&A

2025-12-04

EPSS Evaluated

2026-07-05

NVD

CVE-2025-66571

Affected Vendors & Products

Vendor	Product	Version / Range
una	cms	9.0.0-rc1
una	cms	14.0.0-rc4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability is a PHP object injection in UNA CMS versions 9.0.0-RC1 through 14.0.0-RC4. It occurs because the profile_id POST parameter is passed to the PHP unserialize() function without proper validation or handling. This allows remote, unauthenticated attackers to inject arbitrary PHP objects, which can lead to the execution of arbitrary PHP code on the server.

Impact Analysis

The vulnerability can allow remote attackers to execute arbitrary PHP code on the affected server without authentication. This can lead to full system compromise, data theft, data modification, or disruption of service.

Hi! I’m here to help you understand CVE-2025-66571. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70