| Summary | Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke client (Connection.php:76) calls unserialize() on data received from the server response, enabling client-side RCE if connecting to a malicious server. |
|---|---|
| Publication Date | May 2, 2026, 1:16 a.m. |
| Registration Date | May 2, 2026, 4:07 a.m. |
| Last Update | May 2, 2026, 1:16 a.m. |