Riskcovery

CVE-2025-2376

viames Pair Framework PHP Object UserRemember.php getCookieContent deserialization

State
Published
Severity
6.9 Medium
Published
Mar 17, 2025
Updated
Mar 17, 2025
Reserved
Mar 16, 2025

Read the record on cve.org

Description

A vulnerability has been found in viames Pair Framework up to 1.9.11 and classified as critical. Affected by this vulnerability is the function getCookieContent of the file /src/UserRemember.php of the component PHP Object Handler. The manipulation of the argument cookieName leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Scores

CVSSScoreVectorSource
4.06.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NVulDB
3.17.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LVulDB
3.07.3 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LVulDB
2.07.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:PVulDB

Weaknesses

Affected Products

ProductVersions
Pair Frameworkviames
  • 1.9.0Affected
  • 1.9.1Affected
  • 1.9.2Affected
  • 1.9.3Affected
  • 1.9.4Affected
  • 1.9.5Affected
  • 1.9.6Affected
  • 1.9.7Affected
  • 1.9.8Affected
  • 1.9.9Affected
  • 1.9.10Affected
  • 1.9.11Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.