CVE Intelligence

B2Evolution b2evolution CMS vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting B2Evolution b2evolution CMS: 1 record(s), with affected versions and fixes.

CVE-2026-76834 High · 8.1 CWE-502 Sep 17, 2026
b2evolution CMS 6.7.8 through 7.2.5 Object Injection via Negative Integer Array Key
b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901 where the serialized-array object check in param_check_serialized_array() fails to reject payloads with negative integer array keys. Unauthenticated attackers can submit crafted serialized PHP objects via POST requests to htsrv/call_plugin.php that bypass validation and reach unserialize(), instantiating arbitrary PHP objects with attacker-chosen properties that may enable code execution if suitable POP gadget chains exist.