110175 matches found
CVE-2026-82531 Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache
Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied...
CVE-2026-105985
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding...
CVE-2026-103831 Insecure deserialization in the TrueLayer Magento 2 plugin
CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize function without restrictions on the classes allowed when retrieving data stored in the cache. An attacker who already has the...
CVE-2026-39797
Unauthenticated PHP Object Injection in GDPR Framework By Data443 = 2.5.0 versions...
CVE-2026-104747
Unauthenticated PHP Object Injection in Haaken = 1.5 versions...
CVE-2026-104747 WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Haaken = 1.5 versions...
EUVD-2026-93080
Unauthenticated PHP Object Injection in Haaken = 1.5 versions...
CVE-2026-104747 WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Haaken = 1.5 versions...
CVE-2026-104747
The Haaken WordPress theme versions
EUVD-2026-93041
Unauthenticated PHP Object Injection in GDPR Framework By Data443 = 2.5.0 versions...
CVE-2026-39797 WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in GDPR Framework By Data443 = 2.5.0 versions...
CVE-2026-39797 WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in GDPR Framework By Data443 = 2.5.0 versions...
CVE-2026-39797
The WordPress GDPR Framework By Data443 plugin versions
Exploit for CVE-2026-104905
CVE-2026-104905 — PHP Object Injection in FacturaScripts Widg...
Cacti cmd_realtime.php - Command Injection
Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when registerargcargv option of PHP is On. In cmdrealtime.php line 119, the $pollerid used ...
CLEANSTART-2026-QY88672 In PHP versions 8
Security vulnerability affects the php package. In PHP versions 8...
CLEANSTART-2026-YY93268 In PHP versions 8
Security vulnerability affects the php package. In PHP versions 8...
CLEANSTART-2026-AE99282 In PHP 8
Security vulnerability affects the php package. In PHP 8...