-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems directly from the line '$objProfileArray = unserialize(base64_decode($_POST['strProfileData']));' in profile.php. PHP's unserialize() with user-controlled input is a well-known anti-pattern (CWE-502). The function: 1) Processes raw POST input, 2) Lacks cryptographic signatures or type checks, 3) Exists in an unauthenticated endpoint. The patch in v3.2 adds profiling disable capability but the root vulnerability is the unsafe unserialize() call itself.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| qcubed/qcubed | composer | <= 3.1.1 | 3.2 |
Ongoing coverage of React2Shell