CVE-2026-49781
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
There is an unauthenticated PHP Object Injection vulnerability in OttoKit versions <= 1.1.27.
Risk Assessment
An attacker could exploit this vulnerability to execute unauthorized code, potentially leading to serious security breaches.
Recommendation
It is recommended to update OttoKit to the latest version to mitigate this vulnerability.
Other vulnerabilities in OttoKit
See all- CVE-2026-32553High
OttoKit versions up to 1.1.35 contain an unauthenticated Server Side Request Forgery (SSRF) vulnerability. An attacker can send requests from the server to internal resources.
- CVE-2026-39479High
The OttoKit suretriggers plugin by Brainstorm Force up to version 1.1.20 inclusive is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in an SQL command.
Original NVD description (English source)
Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS