CVE-2025-7216: lty628 Aidigu PHP Object common.php checkUserCookie deserialization

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-09 · updated 2026-06-17
Weakness: CWE-20

Description

A vulnerability, which was classified as critical, was found in lty628 Aidigu up to 1.8.2. This affects the function checkUserCookie of the file /application/common.php of the component PHP Object Handler. The manipulation of the argument rememberMe leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Affected products

lty628 Aidigu: 1.8.0, 1.8.1, 1.8.2

References

https://note-hxlab.wetolink.com/share/Bon2P1OSuNDc
https://vuldb.com/?ctiid.315165
https://vuldb.com/?id.315165
https://vuldb.com/?submit.608209

Get alerted when CVE-2025-7216 or the next vulnerability affects your stack