111908 matches found
CVE-2026-62105: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in ThemeREX Addons 2.45.0 versions...
SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37985)
Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability arises from the failure to properly validate the user ID parameter input in the...
GHSA-X6MC-FGJF-77R7 Duplicate Advisory: GridFS data disclosure and deletion via query-operator injection in file IDs
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8fxw-fmj8-xp7j. This link is maintained to preserve external references. Original Description Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library ca...
Duplicate Advisory: GridFS data disclosure and deletion via query-operator injection in file IDs
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8fxw-fmj8-xp7j. This link is maintained to preserve external references. Original Description Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library ca...
CVE-2026-88023
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...
Imperva Customers Protected Against StyleSmuggler (CVE-2026-75650) in Adobe Commerce and Magento Open Source
TL;DR:CVE-2026-75650 , dubbed StyleSmuggler, is a critical vulnerability affecting Adobe Commerce and Magento Open Source. The vulnerability allows an unauthenticated attacker to inject malicious PHP code into Magento’s template system and achieve remote code execution. Adobe assigned the...
CVE-2026-88023
CVE-2026-88023 affects the GridFS component of the MongoDB PHP Library . The root cause is query-operator injection : a caller-supplied structured file identifier is interpreted as a query condition rather than a literal identifier due to improper neutralization of special elements in data query ...
CVE-2026-88023 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...
CVE-2026-88023 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...
CVE-2026-88023 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...
GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...
CVE-2026-73699
FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize in the Perms::getPerms method, where a positional array is used instead of the required named-key array to...
CVE-2026-73699 FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms()
FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize in the Perms::getPerms method, where a positional array is used instead of the required named-key array to...
EUVD-2026-75601
FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize in the Perms::getPerms method, where a positional array is used instead of the required named-key array to...
CVE-2026-73699 FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms()
FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize in the Perms::getPerms method, where a positional array is used instead of the required named-key array to...
CVE-2026-79987
A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...
EUVD-2026-75586
A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...
CVE-2026-81784
Deserialization of Untrusted Data vulnerability in Marcin Wise Chat wise-chat allows Object Injection.This issue affects Wise Chat: from n/a through 3.4.2...
CVE-2026-81784 WordPress Wise Chat plugin <= 3.4.2 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Marcin Wise Chat wise-chat allows Object Injection.This issue affects Wise Chat: from n/a through 3.4.2...
CVE-2026-81784 WordPress Wise Chat plugin <= 3.4.2 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Marcin Wise Chat wise-chat allows Object Injection.This issue affects Wise Chat: from n/a through 3.4.2...