CVE-2018-1000059

EUVD-2018-1815
ValidFormBuilder version 4.5.4 contains a PHP Object Injection vulnerability in Valid Form unserialize method that can result in Possible to execute unauthorised system commands remotely and disclose file contents in file system.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 49%
Affected Products (NVD)
VendorProductVersion
validformbuildervalidform_builder
4.5.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/validformbuilder/validformbuilder/issues/126
https://github.com/validformbuilder/validformbuilder/issues/126