CVE-2026-62009
Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.
- Risk score
- 74/100
- CVSS
- 9.8 v3.1
- Published
- 29 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A critical vulnerability (CVSS 9.8) allows unauthenticated PHP Object Injection in Filmax versions up to 1.1.11. An attacker could exploit this to gain high privileges, read, modify or delete data, and conduct arbitrary code execution.
- Affected
- {'products': ['Filmax'], 'packages': [], 'versions': ['<= 1.1.11']}
- Fix
- Check the linked advisory for a fix, as none is provided.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
- On your watchlist: php
References
Original description
Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.
Last activity 29 Oct 2026. Patch Forecast updates every hour.