p PatchFirst

CVE-2023-6654

CVE-2023-6654 · PHPEMS Session Data session.cls.php deserialization

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A vulnerability classified as critical was found in PHPEMS 6.x/7.x/8.x/9.0. Affected by this vulnerability is an unknown functionality in the library lib/session.cls.php of the component Session Data Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247357 was assigned to this vulnerability.

CVSS 6.3 · Medium · EPSS 1.7%

Published
Updated

Stack: php

Affected products and versions

  • phpems

    Versions
    • 6.x: Affected
    • 7.x: Affected
    • 8.x: Affected
    • 9.0: Affected

    No fix published

  • phpems/phpems Packagist

    Versions
    • v6.0.0
    • v6.0.1
    • v6.0.10
    • v6.0.2
    • v6.0.2.1
    • v6.0.3
    • v6.0.4
    • v6.0.5
    • v6.0.6
    • v6.0.7
    • v6.0.8
    • v6.0.9
    • v6.1.0
    • v6.1.1
    • v6.1.2
    • v6.1.3
    Affected ranges
    • ECOSYSTEM: ≥ 6.0.0, ≤ 6.1.3

    No fix published

Original sources

Check your server →