CVE-2026-55809

The Flag attendance field module for Drupal (versions 0.0.0 to 1.2) is vulnerable to PHP object injection due to the improper control of modification of dynamically-determined object attributes. The module stores certain data as PHP-serialized strings ; if an attacker can write malicious data dir...