Vulnerability intelligence

CVE-2026-77138

TYPO3 Extension "HTML5 Video Player vs. Powermail" CWE-502

The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.

CVSS Score

9.3

Critical

EPSS — Exploit Probability

0.7%

Riskier than 52% of all CVEs · checked 2026-10-09

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

unknown

Check vendor advisories