Roundcube Webmail - Remote Code Execution

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization. id: CVE-2025-49113 info: name: Roundcube Webmail - Remote...

D-Link DAR-8000-10 - Command Injection

D-Link DAR-8000-10 version has an operating system command injection vulnerability. The vulnerability originates from the parameter id of the file /app/sys1.php which can lead to operating system command injection. id: CVE-2023-4542 info: name: D-Link DAR-8000-10 - Command Injection author:...

CVE-2019-9081_PoC

CVE-2019-9081poc Poc for CVE-2019-9081, this CVE is just a new POP chain. The project is a pre-built vulnerable Laravel 5.7.x application with an entry point for POI vulnerability at URI /deserialize POST-request. Lab setup: Starting the vulnerable application: $ git clone...

Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192

The Block AJAX module enables you to load blocks asynchronously via Ajax. The module doesn't sufficiently validate user-supplied data which is used to construct a block. In the worst case scenario, this can lead to PHP Object Injection and Remote Code Execution. The vulnerability is mitigated by...

Linux Distros Unpatched Vulnerability : CVE-2026-82531

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-compone...

CentOS Linux 8 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1791395301)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1791395301 advisory. - The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes fo...

CVE-2026-97188: Deserialization of Untrusted Data

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...

PT-2026-107405

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromi...

PT-2026-107742

The Block AJAX module enables you to load blocks asynchronously via Ajax. The module doesn't sufficiently validate user-supplied data which is used to construct a block. In the worst case scenario, this can lead to PHP Object Injection and Remote Code Execution. The vulnerability is mitigated by...

CVE-2026-104677: Improper Control of Generation of Code

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromi...

cve-2026-87902-poc

CVE-2026-87902 — WordPress Core: path traversal non autenticato nella risoluzione dei template di pagina Inclusione locale non autenticata di file PHP in WordPress Core tramite un valore pagename con doppia codifica — e, in specifiche condizioni di deployment, esecuzione di codice PHP con i...

CVE-2026-91768 affecting package php for versions less than 8.3.35-1

CVE-2026-91768 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-92842 affecting package php for versions less than 8.3.35-1

CVE-2026-92842 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-93682 affecting package php for versions less than 8.3.35-1

CVE-2026-93682 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-1218 affecting package php for versions less than 8.3.35-1

CVE-2025-1218 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-91767 affecting package php for versions less than 8.3.35-1

CVE-2026-91767 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-91769 affecting package php for versions less than 8.3.35-1

CVE-2026-91769 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-6103 affecting package php for versions less than 8.3.35-1

CVE-2026-6103 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-14181 affecting package php for versions less than 8.3.35-1

CVE-2025-14181 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-17545 affecting package php for versions less than 8.3.35-1

CVE-2026-17545 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...