PT-2025-42509

Name of the Vulnerable Software and Affected Versions Vfront version 0.99.52 Description The file mexcel.php contains a vulnerable call to unserializebase64 decode$ POST'mexcel'. The $ POST'mexcel' parameter is user-controlled input that is decoded from base64 and deserialized without validation...

CVE-2025-60641: Improper Neutralization of Special Elements used in an SQL Command

The file mexcel.php in the Vfront 0.99.52 codebase contains a vulnerable call to unserializebase64decode$POST'mexcel', where $POST'mexcel' is user-controlled input. This input is decoded from base64 and deserialized without validation or use of the allowedclasses option, allowing an attacker to...