110333 matches found
PT-2026-103159
Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce = 2.1.2 versions...
PT-2026-103329
A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqli query of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a manipulation of the argument ID results ...
PT-2026-103483
Name of the Vulnerable Software and Affected Versions Nested Pages versions prior to 3.3.3 Description Nested Pages is subject to a PHP Object Injection issue. This occurs when untrusted data is passed to the unserialize function, allowing an attacker to inject malicious objects into the...
CVE-2026-103592: Use of Less Trusted Source
simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. Attackers can spoof X-Forwarded-For, CF-Connecting-IP, or Client-IP headers to...
CVE-2026-102427: Unrestricted Upload of File with Dangerous Type
Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing task=getContent, a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates th...
PT-2026-103499
yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...
PT-2026-103161
Shop manager PHP Object Injection in Cost of Goods for WooCommerce = 3.5.2 versions...
CVE-2026-102377: Deserialization of Untrusted Data
Contributor PHP Object Injection in Photo Gallery by 10Web = 1.8.46 versions...
PT-2026-103158
Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...
PT-2026-103185
Subscriber PHP Object Injection in Conversational Forms for ChatBot = 1.5.0 versions...
PT-2026-103189
Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...
PT-2026-103490
Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...
CVE-2026-97246: Deserialization of Untrusted Data
Subscriber PHP Object Injection in ShortPixel Image Optimizer = 6.5.5 versions...
CVE-2026-96833: Deserialization of Untrusted Data
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 = 3.5.51 versions...
CVE-2026-94076: Deserialization of Untrusted Data
Contributor PHP Object Injection in SEO Plugin by Squirrly SEO = 14.2.5 versions...
CVE-2026-93624: Deserialization of Untrusted Data
Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...
CVE-2026-102392: Deserialization of Untrusted Data
Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...
CVE-2026-100512: Deserialization of Untrusted Data
Contributor PHP Object Injection in Nested Pages = 3.3.2 versions...
CVE-2026-103229: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqliquery of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a manipulation of the argument ID results i...