SecvalisbySYSDEVOPS.EU
CVE Catalog
EnglishPolski

CVE-2026-66650

CriticalCVSS 9.8
Published: Updated: Translated: NVD NIST

Summary

Unauthenticated PHP Object Injection in FreightCo versions up to 1.1.15. An attacker can send crafted data to execute arbitrary code.

Risk Assessment

Risk of full server or application compromise and data theft.

Recommendation

Update the FreightCo plugin to the latest available version that includes the fix.

Original NVD description (English source)

Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS