Rox vulnerabilities

1 known vulnerability in Rox from BeWelcome. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.4 Critical severity

  Rox: Deserialization of Untrusted Data

  CVE-2025-34292Oct 27, 2025BeWelcome

  Rox, the software running BeWelcome, contains a PHP object injection vulnerability resulting from deserialization of untrusted data. User-controlled input is passed to PHP's unserialize(): the POST parameter `formkit_memory_recovery` in \\RoxPostHandler::getCa