CVE-2025-66571

Name of the Vulnerable Software and Affected Versions UNA CMS versions 9.0.0-RC1 through 14.0.0-RC4

Description The software contains a PHP object injection issue in the BxBaseMenuSetAclLevel.php component. The profile id POST parameter is passed to the PHP unserialize() function without sufficient validation, potentially allowing remote, unauthenticated attackers to inject arbitrary PHP objects and execute code.

Recommendations Versions 9.0.0-RC1 through 14.0.0-RC4: Ensure proper handling of the profile id POST parameter before passing it to the PHP unserialize() function.