VULNERABILITY INTELLIGENCE
CVE-2025-60641
CVSS score6.5 MEDIUM
EPSS probability0.42%
CISA KEVNot currently listed
Published2025-10-16
Last modified2026-07-05
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Description
The file mexcel.php in the Vfront 0.99.52 codebase contains a vulnerable call to unserialize(base64_decode($_POST['mexcel'])), where $_POST['mexcel'] is user-controlled input. This input is decoded from base64 and deserialized without validation or use of the allowed_classes option, allowing an attacker to inject arbitrary PHP objects. This can lead to malicious behavior, such as Remote Code Execution (RCE), SQL Injection, Path Traversal, or Denial of Service, depending on the availability of exploitable classes in the Vfront codebase or its dependencies.
Weakness classification
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-89