CVE-2025-66571

UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed to PHP unserialize() without proper handling, allowing remote, unauthenticated attackers to inject arbitrary PHP objects and potentially write and execute arbitrary PHP code.

CVSS 4.0

9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS

0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-25)

CWE

CWE-502

Published

2025-12-04

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

References

• https://github.com/unacms/una
• https://karmainsecurity.com/KIS-2025-01
• https://unacms.com
• https://www.exploit-db.com/exploits/52139
• https://www.vulncheck.com/advisories/una-cms-900-rc1-1400-rc4-php-object-injection

Check your stackJSON