111315 matches found
CentOS Linux 8.4 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc (CENTOS8.4:CLSA-2026:1772811390)
The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1772811390 advisory. - The izvalptrdtor function in Zend/zendvariables.h in PHP 7.1.5 allows attackers to cause a denial of service memory consumption and...
CentOS Linux 8.5 [TuxCare] Security Update: php-cli / php-common / php-dba / php-fpm / php-mbstring / etc (CENTOS8.5:CLSA-2025:1745530523)
The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2025:1745530523 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...
CVE-2026-95531: Deserialization of Untrusted Data
Subscriber PHP Object Injection in Conversational Forms for ChatBot = 1.5.0 versions...
CVE-2026-94678: Deserialization of Untrusted Data
Contributor PHP Object Injection in Go Live Update Urls = 7.0.8 versions...
PT-2026-103216
Shop manager PHP Object Injection in Content Egg = 6.3.1 versions...
PT-2026-103184
Contributor PHP Object Injection in DesignSetGo = 2.8.0 versions...
PT-2026-103483
Name of the Vulnerable Software and Affected Versions Nested Pages versions prior to 3.3.3 Description Nested Pages is subject to a PHP Object Injection issue. This occurs when untrusted data is passed to the unserialize function, allowing an attacker to inject malicious objects into the...
CVE-2026-94121: Deserialization of Untrusted Data
Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer = 2.33.6 versions...
CVE-2026-103229: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqliquery of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a manipulation of the argument ID results i...
CVE-2026-102427: Unrestricted Upload of File with Dangerous Type
Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing task=getContent, a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates th...
CVE-2026-97248: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Booking Activities = 1.18.7.1 versions...
CVE-2026-96344: Deserialization of Untrusted Data
Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...
CVE-2026-96343: Deserialization of Untrusted Data
Custom role PHP Object Injection in WP ERP = 1.17.9 versions...
CVE-2026-94683: Deserialization of Untrusted Data
Contributor PHP Object Injection in DesignSetGo = 2.8.0 versions...
CVE-2026-93624: Deserialization of Untrusted Data
Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...
CVE-2026-93651: Deserialization of Untrusted Data
Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce = 2.1.2 versions...
CVE-2026-91051: Deserialization of Untrusted Data
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
PT-2026-103328
Name of the Vulnerable Software and Affected Versions OrdaSoft Joomla CCK versions prior to 8.3.16 Description An unauthenticated remote code execution issue exists in the site/uploader.php endpoint, which is accessible via the getContent task. The system fails to perform authentication or Access...