Extension Html5 Video Player Vs Powermail
Monthly
Remote code execution in the TYPO3 'HTML5 Video Player vs. Powermail' extension allows a remote, unauthenticated attacker to achieve arbitrary code execution on the server by supplying a crafted serialized value in an attacker-controlled cookie that is passed to PHP's unserialize(). The flaw is a classic PHP Object Injection (CWE-502) with full confidentiality, integrity, and availability impact and a CVSS 4.0 base score of 9.3. No public exploit identified at time of analysis, but the trivial attack requirements make weaponization straightforward.
Remote code execution in the TYPO3 'HTML5 Video Player vs. Powermail' extension allows a remote, unauthenticated attacker to achieve arbitrary code execution on the server by supplying a crafted serialized value in an attacker-controlled cookie that is passed to PHP's unserialize(). The flaw is a classic PHP Object Injection (CWE-502) with full confidentiality, integrity, and availability impact and a CVSS 4.0 base score of 9.3. No public exploit identified at time of analysis, but the trivial attack requirements make weaponization straightforward.