CVE-2016-8580

9.8 criticalEPSS 6.9%

PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before 5.3.2. These vulnerabilities allow arbitrary PHP code execution via magic methods in included classes.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 6.9% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWE: CWE-284
Published: 2016-10-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

alienvault:open_source_security_information_and_event_management
alienvault:unified_security_management

References

http://www.securityfocus.com/bid/93864
https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities
https://www.exploit-db.com/exploits/40682/
http://www.securityfocus.com/bid/93864
https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities

Check your stack JSON