Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
An insecure deserialization vulnerability exists in the download.php script of the to3k Twittodon application through commit b1c58a7d1dc664b38deb486ca290779621342c0b (2023-02-28). The 'obj' parameter receives base64-encoded data that is passed directly to the unserialize() function without validation. This allows a remote, unauthenticated attacker to inject arbitrary PHP objects, leading to a denial of service.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 HIGH SEVERITY: CVE-2025-63950 (CVSS 7.5) Insecure deserialization in to3k Twittodon allows unauthenticated remote attackers to trigger DoS via crafted PHP objects in download[.]php. Patch immediately. #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/n0E2McLxJa
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | tomaszdunia | twittodon | - | - | - |