110429 matches found
PT-2026-49399
Contributor PHP Object Injection in Events Calendar for GeoDirectory = 2.3.25 versions...
CVE-2026-9691: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms = 1.1.1 versions...
CVE-2026-39532: Deserialization of Untrusted Data
Contributor PHP Object Injection in Events Calendar for GeoDirectory = 2.3.25 versions...
CVE-2026-39481: Deserialization of Untrusted Data
Author PHP Object Injection in Modula Image Gallery = 2.14.18 versions...
CVE-2026-39498: Deserialization of Untrusted Data
Shop manager PHP Object Injection in YayMail = 4.3.3 versions...
CVE-2026-39478: Deserialization of Untrusted Data
Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall = 4.23.87 versions...
CVE-2026-49769: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in wpForo Forum = 3.1.0 versions...
CVE-2026-49104: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms = 1.2.1 versions...
VulnCheck KEV: CVE-2026-48908
JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code...
CVE-2026-49781: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in OttoKit = 1.1.27 versions...
CVE-2026-49770: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in WP Travel Engine = 6.7.12 versions...
CVE-2026-49106: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact = 1.1.6 versions...
CVE-2026-38329
Bludit CMS versions prior to 3.18.4 are vulnerable to Remote Code Execution (RCE) within the API Plugin . The issue resides in the bl-plugins/api/plugin.php file, where the POST /api/files/{key} endpoint fails to perform adequate authorization checks and lacks file extension validation . Conseque...
CVE-2026-39474: Deserialization of Untrusted Data
Contributor PHP Object Injection in Post Duplicator = 3.0.10 versions...
CVE-2026-48157: Improper Neutralization of Input During Web Page Generation
Slim is a PHP micro framework that enables users to write simple web applications and APIs. In versions 4.4.0 through 4.15, if an application uses HttpException::setTitle and/or setDescription to include untrusted/request-derived data in the error title or description e.g. "No products found...
[SECURITY] Fedora 43 Update: composer-2.10.1-1.fc43
Composer helps you declare, manage and install dependencies of PHP projects, ensuring you have the right stack everywhere. Documentation: https://getcomposer.org/doc/...
CVE-2026-12176
SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 contains a cross-site scripting (XSS) vulnerability in an unknown function of the file /index.php when the action parameter is manipulated. The attack is remote and has been publicly disclosed . Exploit maturity is label...
CVE-2026-9062
The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary .php files from the server, including configuration files that contain database credentials and authentication keys...
CVE-2026-9062 Agile Store Locator < 1.6.9 - Admin+ Arbitrary File Read via Path Traversal
The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary .php files from the server, including configuration files that contain database credentials and authentication keys...