WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Avala versions = 1.1.4...

WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme WineShop versions = 3.20...

WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Equadio versions = 1.1.4...

WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Juno versions = 2.25...

WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme N7 | Golf Club Sports & Events versions = 2.21...

WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Invetex versions = 2.18...

WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Law Office versions = 3.20...

CVE-2026-107362 Server-Side Request Forgery in Malcolm

Malcolm file-upload component ships the upstream FilePond PHP server pqina/filepond-server-php largely unmodified: Dockerfile copies all upstream .php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download an...

EUVD-2026-95118

Malcolm file-upload component ships the upstream FilePond PHP server pqina/filepond-server-php largely unmodified: Dockerfile copies all upstream .php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download an...

CVE-2026-107362 Server-Side Request Forgery in Malcolm

Malcolm file-upload component ships the upstream FilePond PHP server pqina/filepond-server-php largely unmodified: Dockerfile copies all upstream .php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download an...

CVE-2026-107362

The Malcolm file-upload component is vulnerable to a Server-Side Request Forgery (SSRF) due to its inclusion of the upstream FilePond PHP server (pqina/filepond-server-php) with largely unmodified files. Specifically, the upstream index.php contains a fetch API route that uses curl (with FOLLOWLO...

WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.8 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WooCommerce Multilingual & Multicurrency versions = 5.5.8...

WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by V1T in WordPress Plugin AFFI – Affiliate Marketing for WooCommerce versions = 1.0.10...

WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Asia Garden versions = 1.3.1...

WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Plugin Super Video Player versions = 1.8.14...

hashes

Hash magici – "collisioni" di hash PHP Registrati con password 1 e poi accedi con password 2. Se riesci ad accedere, l'archiviazione usa l'algoritmo specificato per calcolare l'hash della password e PHP usa == per confrontarle per MD5, SHA-1 e plaintext. MD5, SHA-1, SHA-224, SHA-256 e altri Per M...

dompdf-rce

Exploit RCE per dompdf Questo repository contiene un'applicazione demo vulnerabile che utilizza dompdf 1.2.0 e un exploit che consente l'esecuzione remota di codice tramite un file poliglotta ttf+php. Per maggiori dettagli, visita https://positive.security/blog/dompdf-rce Istruzioni 1. Esegui...

phpggc

PHPGGC: Catene di Gadget Generici PHP PHPGGC è una libreria di payload unserialize insieme a uno strumento per generarli, da riga di comando o programmaticamente. Quando incontri una unserialize su un sito web di cui non hai il codice, o semplicemente quando cerchi di costruire un exploit, questo...

php_filter_chains_oracle_exploit

PHP filter chains: lettura di file da oracolo basato su errori Una CLI per sfruttare parametri affetti dalla lettura di file causata dall'oracolo basato su errori delle catene di filtri PHP. Può essere usata per esfiltrare il contenuto di un file locale quando viene passato a funzioni vulnerabili...

DEBIAN-CVE-2026-105830

league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters,...