Description
An insecure deserialization vulnerability exists in the rss-mp3.php script of the MiczFlor RPi-Jukebox-RFID project through commit 4b2334f0ae0e87c0568876fc41c48c38aa9a7014 (2025-10-07). The 'rss' GET parameter receives data that is passed directly to the unserialize() function without validation. This allows a remote, unauthenticated attacker to inject arbitrary PHP objects, causing the application to process them and leading to errors or a denial of service.
INFO
Published Date :
2025-12-18T00:00:00.000Z
Last Modified :
2025-12-18T21:17:52.996Z
Source :
mitre
AFFECTED PRODUCTS
The following products are affected by CVE-2025-63951 vulnerability.
No data.
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-63951.
