110178 matches found
CVE-2026-16767 Ne-Lexa php-zip ZIP ZipFile.php extractTo path traversal
A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal. It is possible to initiate the attack remotely. The...
CVE-2026-16767
A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal. It is possible to initiate the attack remotely. The...
CVE-2026-16765
A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of the argument aid can lead to sql injection. The attack can be executed remotely. The exploit has been...
CVE-2026-65497
Administrator PHP Object Injection in Complianz = 7.5.0 versions...
CVE-2026-65497 WordPress Complianz plugin <= 7.5.0 - PHP Object Injection vulnerability
Administrator PHP Object Injection in Complianz = 7.5.0 versions...
CVE-2026-65497
CVE-2026-65497 concerns the WordPress Complianz plugin, affected in versions ≤ 7.5.0, with a PHP Object Injection vulnerability identifiable under the described Administrator context. The root cause is a PHP object injection flaw within Complianz that could be exploited via a network attack vecto...
CVE-2026-65493 WordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in Dokan Pro = 5.0.2 versions...
CVE-2026-65493
Subscriber PHP Object Injection in Dokan Pro = 5.0.2 versions...
CVE-2026-59544
The CVE covers WordPress Thrive Quiz Builder plugin versions
CVE-2026-59544 WordPress Thrive Quiz Builder plugin <= 10.9.3.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Thrive Quiz Builder = 10.9.3.0 versions...
EUVD-2026-48197
Unauthenticated PHP Object Injection in Thrive Quiz Builder = 10.9.3.0 versions...
CVE-2026-15011
The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...
WordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Expatch in WordPress Plugin Dokan Pro versions = 5.0.2...
Exploit for OS Command Injection in Php
CVE-2024-4577 - PHP CGI Argument Injection on Windows "WorstF...
CVE-2026-59544: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Thrive Quiz Builder = 10.9.3.0 versions...
CVE-2026-65481: Improper Control of Filename for Include/Require Statement in PHP Program
Contributor Local File Inclusion in Vino = 1.9 versions...
CVE-2026-65493: Deserialization of Untrusted Data
Subscriber PHP Object Injection in Dokan Pro = 5.0.2 versions...
PT-2026-64194
Name of the Vulnerable Software and Affected Versions Ne-Lexa php-zip versions prior to 4.0.3 Description A path traversal issue exists in the ZIP Handler component within the ZipFile::extractTo function located in the src/ZipFile.php file. A remote attacker can exploit this by manipulating the...
CVE-2026-16767: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal. It is possible to initiate the attack remotely. The...