CVE-2026-62016

{
  "etk_id": "ETK-2026-3000",
  "cve_id": "CVE-2026-62016",
  "display_id": "CVE-2026-62016",
  "ghsa_id": "GHSA-v35g-pjfq-8qfw",
  "euvd_id": "EUVD-2026-112979",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated PHP object injection in ThemeREX Gamic",
  "summary": "ThemeREX Gamic versions 1.19 and earlier are affected by an unauthenticated PHP object injection flaw. An unauthenticated attacker may be able to trigger unsafe object handling; the advisory identifies use of an affected version as the stated prerequisite.",
  "mitigation": "Disable or replace ThemeREX Gamic 1.19 and earlier where possible, and restrict unauthenticated access to affected deployments until an updated release is available. Obtain and apply the vendor's corrected version when it is published.",
  "vendor": "ThemeREX",
  "product": "Gamic",
  "affected": [
    {
      "affected_notes": [
        ">= n/a, <= 1.19"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Gamic",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.0094631,
  "t0_at": "2026-10-29T15:24:24.535000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-29T19:25:25.491943+00:00",
      "days": 0.16737218684027777,
      "is_lower_bound": false,
      "measured_at": "2026-10-29T15:24:24.535000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-29T15:24:24.535000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-29T15:24:24.535000+00:00",
      "url": "https://github.com/advisories/GHSA-v35g-pjfq-8qfw"
    }
  }
}