CVE-2025-63951

An insecure deserialization vulnerability exists in the rss-mp3.php script of the MiczFlor RPi-Jukebox-RFID project through commit 4b2334f0ae0e87c0568876fc41c48c38aa9a7014 (2025-10-07). The 'rss' GET parameter receives data that is passed directly to the unserialize() function without validation. This allows a remote, unauthenticated attacker to inject arbitrary PHP objects, causing the application to process them and leading to errors or a denial of service.

• CWE-502

• https://github.com/solonbarroso/vulnerability-research/blob/main/advisories/RPi-Jukebox-RFID/CVE-2025-63951.mdExploit, Third Party Advisory
• https://github.com/solonbarroso/vulnerability-research/blob/main/advisories/RPi-Jukebox-RFID/CVE-pending-Deserialization.mdExploit, Third Party Advisory

Published

Dec 18, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-63946A privilege escalation (PE) vulnerability in the Tencent PC …7.4
• CVE-2025-63947A Reflected Cross-Site Scripting (XSS) vulnerability exists …5.4
• CVE-2025-63948A SQL Injection vulnerability exists in phpMsAdmin version 2…5.4
• CVE-2025-63949A Reflected Cross-Site Scripting (XSS) vulnerability in yoha…6.1
• CVE-2025-6395A NULL pointer dereference flaw was found in the GnuTLS soft…6.5
• CVE-2025-63950An insecure deserialization vulnerability exists in the down…7.5
• CVE-2025-63952A Cross-Site Request Forgery (CSRF) in the /mwapi?method=add…5.7
• CVE-2025-63953A Cross-Site Request Forgery (CSRF) in the /usapi?method=add…6.5
• CVE-2025-63955A Cross-Site Request Forgery (CSRF) vulnerability in the man…7.5
• CVE-2025-63958MILLENSYS Vision Tools Workspace 6.5.0.2585 exposes a sensit…9.8
• CVE-2025-6396Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2025-6397Improper Neutralization of Input During Web Page Generation …8.6