CVE-2026-77138 in HTML5 Video Player vs. Powermail Plugin
Tóm tắt
Bởi MITRE • 25/08/2026
The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.
VulDB is the best source for vulnerability data and more expert information about this specific topic.