CVE-2026-66565

{
  "etk_id": "ETK-2026-1198",
  "cve_id": "CVE-2026-66565",
  "display_id": "CVE-2026-66565",
  "ghsa_id": "GHSA-gpxw-g22x-43pr",
  "euvd_id": "EUVD-2026-96519",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated PHP object injection in axiomthemes FC United",
  "summary": "axiomthemes FC United versions through 1.1.1 are affected by an unauthenticated PHP object injection flaw. An unauthenticated remote attacker may be able to inject PHP objects where an affected installation is reachable.",
  "mitigation": "Disable or remove affected FC United installations, or restrict their public access, until a vendor-fixed release is available. Upgrade to the vendor’s corrected version once one is published.",
  "vendor": "axiomthemes",
  "product": "FC United",
  "affected": [
    {
      "affected_notes": [
        ">= n/a, <= 1.1.1"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "FC United",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0031,
  "epss_percentile": 0.2283,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 26.315300116666666,
  "t0_at": "2026-10-10T19:36:11.322000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-10T19:36:11.322000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-10T19:36:11.322000+00:00",
      "url": "https://github.com/advisories/GHSA-gpxw-g22x-43pr"
    }
  }
}