Description
The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object.
Remediation
References
Related Vulnerabilities
PHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2007-4850)
WordPress Plugin Tune Library SQL Injection (1.5.4)
WordPress Plugin Import all XML, CSV & TXT into WordPress Security Bypass (6.4.1)
MediaWiki Improper Authentication Vulnerability (CVE-2011-1766)
Plone CMS URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2016-7137)