Live › vulnerability › CVE-2026-54856
RexCoin versions 1.2.6 and earlier contain a PHP object injection flaw that an unauthenticated request can trigger. Successful exploitation can let an attacker run code or control application logic on the server, according to the NVD record's CVSS 9.8 critical score.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Sites running the RexCoin plugin at version 1.2.6 or earlier are in scope. The sources do not name the vulnerable endpoint or whether a default configuration is exposed, so teams running RexCoin should treat any installed copy as potentially affected until the vendor or NVD states otherwise.
No product ranges from the sources yet.
1.2.6 and below are listed as affected.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-54856")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.