CVE-2026-97865

Name of the Vulnerable Software and Affected Versions Open-Web-Analytics versions prior to 1.8.2

Description A flaw in the Remote Event Queue Endpoint component allows remote attackers to trigger deserialization by manipulating the Event::loadFromArray() function within the queue.php file. Deserialization is a process where data stored in a format like JSON or XML is converted back into an object that the application can use, which can be exploited to execute unauthorized code if the input is not properly validated.

Recommendations Update to version 1.8.2.