#php

The same vulnerable line has been in Kaltura's video player since 2015, and there is still no patch

Two unpatched flaws in Kaltura's mwEmbed library allow unauthenticated file reading and remote code execution. The researcher traced the vulnerable unserialize() call as byte-identical across 21 releases, from April 2015 to a commit made this month. He spent five months trying to reach the vendor. CERT/CC could not reach them either.