CVE-2026-66564 Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions

Description

Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.

Affected products and versions

Product	Affected versions	Fixed in
ShiftCV 3.0	earliest → 3.0.14	No fix stated

Other CVEs of ShiftCV

The 2 CVEs of ShiftCV →

CVE-2026-28015 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in… 8.1 High