CVE-2025-60641 | BDVDB-2026-298401 Detail

Description#

The file mexcel.php in the Vfront 0.99.52 codebase contains a vulnerable call to unserialize(base64_decode($_POST['mexcel'])), where $_POST['mexcel'] is user-controlled input. This input is decoded from base64 and deserialized without validation or use of the allowed_classes option, allowing an attacker to inject arbitrary PHP objects. This can lead to malicious behavior, such as Remote Code Execution (RCE), SQL Injection, Path Traversal, or Denial of Service, depending on the availability of exploitable classes in the Vfront codebase or its dependencies.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12025-10-16Record published in the CVE List.
2. Version 22026-07-05Most recent update recorded in the CVE List.