Vulnerabilidades de B2Evolution
CVEs publicadas que afetam produtos de B2Evolution: 2 registro(s), com severidade, exploração e correções.
CVE-2026-76834
Alta · 8.1
CWE-502 17/09/2026
b2evolution CMS 6.7.8 through 7.2.5 Object Injection via Negative Integer Array Key
b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901 where the serialized-array object check in param_check_serialized_array() fails to reject payloads with negative integer array keys. Unauthenticated attackers can submit crafted serialized PHP objects via POST requests to htsrv/call_plugin.php that bypass validation and reach unserialize(), instantiating arbitrary PHP objects with attacker-chosen properties that may enable code execution if suitable POP gadget chains exist.
CVE-2021-47800
Média · 5.3
CWE-352 15/01/2026
b2evolution 7.2.2 - 'edit account details' Cross-Site Request Forgery (CSRF)
b2evolution 7.2.2 contains a cross-site request forgery vulnerability that allows attackers to modify admin account details without authentication. Attackers can craft a malicious HTML form to submit unauthorized changes to user profiles by tricking victims into loading a specially crafted webpage.