PULSE
EN
FEED
ransombooba project reclama a LifeFone · US · Healthcareransombooba project reclama a National Association of Credit Management · US · Financial Servicesransombooba project reclama a California School Boards Association · US · Educationransombooba project reclama a South Weber City · US · Government & Defenseransombooba project reclama a Programs for Parents, Inc. · US · Educationransombooba project reclama a Circleville Police Department · US · Government & Defenseransomemperador reclama a MAA Group Consulting Engineers · Professional Servicesransomrhysida reclama a ClaimTek Systems · Financial Servicesransomlockbit5 reclama a xspringcapital.com · SG · Financial Servicesransomlockbit5 reclama a susannecerda.com · MXransomanubis reclama a Santiam Hospital & Clinics · US · Healthcareransomsilentransomgroup reclama a Lowenstein Sandler LLP · US · Professional Servicesransompear reclama a Cyrious Software · US · Technologyransomwallstreet reclama a Fortrex · US · Manufacturingransombooba project reclama a LifeFone · US · Healthcareransombooba project reclama a National Association of Credit Management · US · Financial Servicesransombooba project reclama a California School Boards Association · US · Educationransombooba project reclama a South Weber City · US · Government & Defenseransombooba project reclama a Programs for Parents, Inc. · US · Educationransombooba project reclama a Circleville Police Department · US · Government & Defenseransomemperador reclama a MAA Group Consulting Engineers · Professional Servicesransomrhysida reclama a ClaimTek Systems · Financial Servicesransomlockbit5 reclama a xspringcapital.com · SG · Financial Servicesransomlockbit5 reclama a susannecerda.com · MXransomanubis reclama a Santiam Hospital & Clinics · US · Healthcareransomsilentransomgroup reclama a Lowenstein Sandler LLP · US · Professional Servicesransompear reclama a Cyrious Software · US · Technologyransomwallstreet reclama a Fortrex · US · Manufacturing
← Todos los CVEs
CVE Watch23 jul 2026

CVE-2026-10721

Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the  in Permission, Cache, and Search components.

CVSS

—

Sin CVSS

EPSS

0.1%

p4

KEV

—

Exploit Today

1

0-100

Publicado: 10 jun 2026 · Última mod.: 23 jul 2026 · CWE-502

EPSS · 30d
0.1%EPSS · 30 días0.1%
2026-09-302026-10-28
Descripción técnica

Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the  in Permission, Cache, and Search components. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database. Thanks XananasX7 for reporting.

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-621319.8 CRÍ
—
———Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.2hCVE-2026-620189.8 CRÍ
—
———Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.2hCVE-2026-620179.8 CRÍ
—
———Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.2hCVE-2026-620169.8 CRÍ
—
———Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.2hCVE-2026-620159.8 CRÍ
—
———Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.2hCVE-2026-620149.8 CRÍ
—
———Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.2h