unserialize is called on request data allowing object injection and remote code execution.
Use json_decode for untrusted data or pass allowed_classes=>false to unserialize.