Description
Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace function.
References (1)
Core 1
Core References
Scores
CVSS v3
9.8
EPSS
0.0146
EPSS Percentile
70.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-502
Status
published
Products (1)
publiccms/publiccms
4.0.202302.e
Published
Nov 20, 2023
Tracked Since
Feb 18, 2026