CVE-2016-5726

Packages.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the themechanges array parameter.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2017-02-09

Last modified

2024-08-06

Weaknesses

CWE-94

Affected products

• Simple Machines Forum (Simplemachines)

References

• http://www.openwall.com/lists/oss-security/2016/06/10/7
• http://www.openwall.com/lists/oss-security/2016/06/18/1