As part of my research into Gadget Chains and PHP Object Injection, I discovered exploitable vulnerabilities in three different XOOPS modules.
The XOOPS team responded quickly to my report, and fixes were released not long after. They were very good to work with.
They published details here:
https://xoops.org/modules/newbb/viewtopic.php?topic_id=79555
The specific fixes were:
