tag

deserialization

1 article with this tag

CVSS9.32026-06-08

CVE-2026-45247 — unauthenticated RCE in a Magento extension via PHP object injection

PHP object injection (CWE-502) in Mirasvit Full Page Cache Warmer for Magento 2 before 1.11.12 reaches unauthenticated RCE. CVSS 9.3. The real fix is updating to 1.11.12+. The root rule: never deserialize untrusted data.

← All tags