CVE-2025-2376: viames Pair Framework PHP Object UserRemember.php getCookieContent deserialization

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-17 · updated 2026-06-17
Weakness: CWE-20

Description

A vulnerability has been found in viames Pair Framework up to 1.9.11 and classified as critical. Affected by this vulnerability is the function getCookieContent of the file /src/UserRemember.php of the component PHP Object Handler. The manipulation of the argument cookieName leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Affected products

viames Pair Framework: 1.9.0, 1.9.1, 1.9.2, 1.9.3, 1.9.4, 1.9.5 (+6)

References

https://gist.github.com/mcdruid/1997e10026833d2d1f3e359d75b5912a
https://vuldb.com/?ctiid.299875
https://vuldb.com/?id.299875
https://vuldb.com/?submit.515735

Get alerted when CVE-2025-2376 or the next vulnerability affects your stack