CVE-2025-66571

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-66571", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2025-12-04T16:17:41.799Z", "datePublished": "2025-12-04T20:43:52.499Z", "dateUpdated": "2026-07-28T01:48:12.218Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "UNA CMS", "vendor": "Unknown", "versions": [{"lessThanOrEqual": "14.0.0-RC4", "status": "affected", "version": "9.0.0-RC1", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:una:una:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.0.0", "versionEndIncluding": "14.0.0"}]}]}], "credits": [{"lang": "en", "type": "finder", "value": "Egidio Romano aka EgiX"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed to PHP unserialize() without proper handling, allowing remote, unauthenticated attackers to inject arbitrary PHP objects and potentially write and execute arbitrary PHP code.</p>"}], "value": "UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed to PHP unserialize() without proper handling, allowing remote, unauthenticated attackers to inject arbitrary PHP objects and potentially write and execute arbitrary PHP code."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-28T01:48:12.218Z"}, "references": [{"name": "ExploitDB-52139", "tags": ["exploit"], "url": "https://www.exploit-db.com/exploits/52139"}, {"name": "UNA CMS Homepage", "tags": ["product"], "url": "https://unacms.com"}, {"name": "UNA CMS GitHub Repository", "tags": ["product"], "url": "https://github.com/unacms/una"}, {"name": "Karma Security Advisory", "tags": ["vdb-entry"], "url": "https://karmainsecurity.com/KIS-2025-01"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/una-cms-900-rc1-1400-rc4-php-object-injection"}], "source": {"discovery": "UNKNOWN"}, "title": "UNA CMS 9.0.0-RC1 - 14.0.0-RC4 PHP Object Injection", "x_generator": {"engine": "vulncheck"}, "datePublic": "2025-04-08T00:00:00.000Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-05T16:07:45.870391Z", "id": "CVE-2025-66571", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T16:48:10.075Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-66571", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-05T16:07:45.870391Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T16:46:16.294Z"}}], "cna": {"title": "UNA CMS 9.0.0-RC1 - 14.0.0-RC4 PHP Object Injection", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Egidio Romano aka EgiX"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Unknown", "product": "UNA CMS", "versions": [{"status": "affected", "version": "9.0.0-RC1", "versionType": "custom", "lessThanOrEqual": "14.0.0-RC4"}], "defaultStatus": "unaffected"}], "datePublic": "2025-04-08T00:00:00.000Z", "references": [{"url": "https://www.exploit-db.com/exploits/52139", "name": "ExploitDB-52139", "tags": ["exploit"]}, {"url": "https://unacms.com", "name": "UNA CMS Homepage", "tags": ["product"]}, {"url": "https://github.com/unacms/una", "name": "UNA CMS GitHub Repository", "tags": ["product"]}, {"url": "https://karmainsecurity.com/KIS-2025-01", "name": "Karma Security Advisory", "tags": ["vdb-entry"]}, {"url": "https://www.vulncheck.com/advisories/una-cms-900-rc1-1400-rc4-php-object-injection", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed to PHP unserialize() without proper handling, allowing remote, unauthenticated attackers to inject arbitrary PHP objects and potentially write and execute arbitrary PHP code.", "supportingMedia": [{"type": "text/html", "value": "<p>UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed to PHP unserialize() without proper handling, allowing remote, unauthenticated attackers to inject arbitrary PHP objects and potentially write and execute arbitrary PHP code.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:una:una:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "14.0.0", "versionStartIncluding": "9.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-28T01:48:12.218Z"}}}, "cveMetadata": {"cveId": "CVE-2025-66571", "state": "PUBLISHED", "dateUpdated": "2026-07-28T01:48:12.218Z", "dateReserved": "2025-12-04T16:17:41.799Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2025-12-04T20:43:52.499Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "UNA CMS", "vendor": "Unknown", "versions": [{"lessThanOrEqual": "14.0.0-RC4", "status": "affected", "version": "9.0.0-RC1", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed to PHP unserialize() without proper handling, allowing remote, unauthenticated attackers to inject arbitrary PHP objects and potentially write and execute arbitrary PHP code."}, {"lang": "es", "value": "Las versiones 9.0.0-RC1 - 14.0.0-RC4 de UNA CMS contienen una vulnerabilidad de inyecci\u00f3n de objetos PHP en BxBaseMenuSetAclLevel.php donde el par\u00e1metro POST profile_id se pasa a PHP unserialize() sin el manejo adecuado, lo que permite a atacantes remotos no autenticados inyectar objetos PHP arbitrarios y potencialmente escribir y ejecutar c\u00f3digo PHP arbitrario."}], "id": "CVE-2025-66571", "lastModified": "2026-10-18T15:10:00.097", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66571", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-05T16:07:45.870391Z", "version": "2.0.3"}}]}, "published": "2025-12-04T21:16:09.747", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/unacms/una"}, {"source": "disclosure@vulncheck.com", "url": "https://karmainsecurity.com/KIS-2025-01"}, {"source": "disclosure@vulncheck.com", "url": "https://unacms.com"}, {"source": "disclosure@vulncheck.com", "url": "https://www.exploit-db.com/exploits/52139"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/una-cms-900-rc1-1400-rc4-php-object-injection"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T20:58:44.921990+00:00", "value": {"mitigation_remediation": ["Apply the latest UNA CMS update that addresses the object injection flaw; if a patch is available, upgrade immediately.", "If an upgrade is not available, restrict external access to the BxBaseMenuSetAclLevel.php endpoint or limit POST requests to authenticated users only, effectively blocking unauthenticated exploitation.", "Disable PHP's unserialize() for untrusted data by adding 'unserialize' to php.ini's disable_functions setting or by employing a wrapper that validates serialized strings before deserialization. This blocks object creation until a patch is applied."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The affected system is UNA CMS, a content management platform. All releases from version 9.0.0-RC1 up to 14.0.0-RC4 are vulnerable. No specific distribution vendor beyond UNA CMS is listed, but any deployment using these releases is at risk.", "description_and_impact": "UNA CMS versions 9.0.0-RC1 through 14.0.0-RC4 expose a PHP object injection flaw in BxBaseMenuSetAclLevel.php. The vulnerability arises because the profile_id POST parameter is passed directly to PHP unserialize() without sanitization, allowing an attacker to inject arbitrary PHP objects. This flaw can lead to the execution of malicious PHP code, providing full control over the affected web server and compromising confidentiality, integrity, and availability. The weakness is identified as CWE-502.", "risk_and_exploitability": "The CVSS score of 9.3 reflects the severity of arbitrary code execution possible without authentication. The EPSS score of less than 1% indicates that, despite high severity, the probability of exploitation in the wild is currently low, likely due to limited exposure or discovery. The vulnerability is not yet listed in CISA's KEV catalog. The most probable attack vector is a remote, unauthenticated POST request to the BxBaseMenuSetAclLevel.php endpoint with a crafted profile_id value. An attacker would need to send a serialized payload that instantiates objects capable of performing write and execute operations on the server."}}}}, "created": "2025-12-05T10:52:26.811207+00:00", "updated": "2026-04-22T21:00:06.372358+00:00", "vendors": ["unacms", "unacms$PRODUCT$una"]}