QwikSec

Security Database

CVE

CWE

Training

CVE-2025-66631

Published: Dec 9, 2025

Modified: Dec 9, 2025

PUBLISHED

Description

CSLA .NET is a framework designed for the development of reusable, object-oriented business layers for applications. Versions 5.5.4 and below allow the use of WcfProxy. WcfProxy uses the now-obsolete NetDataContractSerializer (NDCS) and is vulnerable to remote code execution during deserialization. This vulnerability is fixed in version 6.0.0. To workaround this issue, remove the WcfProxy in data portal configurations.

Vendor	Product	Versions
MarimerLLC	csla	affected `< 6.0.0`

Weaknesses (CWE)

References

https://github.com/MarimerLLC/csla/security/advisories/GHSA-wq34-7f4g-953v

x_refsource_CONFIRM

https://github.com/MarimerLLC/csla/issues/4001

x_refsource_MISC

https://github.com/MarimerLLC/csla/pull/4018

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.