CVE-2026-78531

{
  "etk_id": "ETK-2026-1193",
  "cve_id": "CVE-2026-78531",
  "display_id": "CVE-2026-78531",
  "ghsa_id": "GHSA-5568-p4h7-h6jx",
  "euvd_id": "EUVD-2026-96526",
  "status": "published",
  "anchor_state": "anchored",
  "title": "PHP object injection in themerex Jacqueline",
  "summary": "themerex Jacqueline versions through 2.22 are affected by PHP object injection. An unauthenticated remote attacker may be able to trigger unsafe object deserialization when the affected application functionality is exposed.",
  "mitigation": "Update to a vendor-supported Jacqueline release newer than 2.22 after confirming it addresses this issue. Until then, restrict unauthenticated access to the affected application functionality.",
  "vendor": "ThemeREX",
  "product": "Jacqueline",
  "affected": [
    {
      "affected_notes": [
        ">= n/a, <= 2.22"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Jacqueline",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0031,
  "epss_percentile": 0.2295,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 28.692732833333334,
  "t0_at": "2026-10-10T19:36:16.484000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-10T23:39:23.518352+00:00",
      "days": 0.1688314161111111,
      "is_lower_bound": false,
      "measured_at": "2026-10-10T19:36:16.484000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-10T19:36:16.484000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-10T19:36:16.484000+00:00",
      "url": "https://github.com/advisories/GHSA-5568-p4h7-h6jx"
    }
  }
}