2025-10-04

Deserialization vulnerability in LaChatterie Verger up to 1.2.10 allows remote authenticated attackers with low privileges to abuse the OAuth redirect functionality. By supplying a crafted URL containing malicious serialized data to the `redirectToAuthorization` function, an attacker can trigger deserialization, potentially leading to limited data tampering or service disruption. A public exploit is available, but no active exploitation is confirmed.

A security vulnerability in SeriaWei ZKEACMS (CVSS 5.4). Remediation should follow standard vulnerability management procedures.