SZB-7c5396a0ef
EUVD-2026-112985 reports PHP object injection in Zippy editor
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Gesundheit Bewegt GmbH
- Product
- Zippy
- First seen
Summary
The EU Vulnerability Database (EUVD) lists a PHP object injection flaw, scored 7.2 (CVSS v3.1), in Zippy up to version 1.7.0. The listing was published 2026-10-29 and updated 2026-10-30.
If you use Gesundheit Bewegt GmbH
Update Zippy to a version later than 1.7.0 if one is available
Restrict editor-level accounts to trusted users until patched
Contact the vendor for a fix or advisory
What the sources say 1
· Mastodon: “Editor PHP Object Injection in Zippy <= 1.7.0 versions.” Source