SZB-220c9c8573
EUVD lists shop manager PHP object injection in Finale Lite up to 2.21.0
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Daman Jeet
- Product
- Finale Lite
- First seen
Summary
An EUVD record (EUVD-2026-112991), shared via a Mastodon post, describes a shop manager PHP object injection flaw in Finale Lite up to version 2.21.0. The record gives a CVSS v3.1 score of 7.2/10 and was published 2026-10-29 and updated 2026-10-30.
If you use Daman Jeet
Update Finale Lite to a version later than 2.21.0 once a fix is released
Check EUVD-2026-112991 for vendor guidance and patch status
Limit shop manager role assignments until the plugin is patched
What the sources say 1
· Mastodon: “Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.” Source