110557 matches found
CVE-2026-104723 LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, ...
EUVD-2026-96108
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, ...
CVE-2026-104723
The LifterLMS WordPress plugin (versions
CVE-2026-104899
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress (versions up to and including 2.8.187 ) are vulnerable to Local File Inclusion (LFI) . The root cause is an insecure handling of the 'design_type' parameter , which allows unauthenticated attack...
CVE-2026-103889 3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter
The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpvimage' parameter parameter. This is due to missing authentication and nonce checks on the wploaded handler combined with no sanitization...
CVE-2025-69212-PoC
CVE-2025-69212 - OpenSTAManager OS Command Injection PoC Usage Install dependencies: pip install -r requirements.txt Run a single command and print its output: python3 cve-2025-69212poc.py -u http://target.com -U admin -P 'password' -c 'id' Drop a persistent PHP webshell instead: python3...
CVE-2026-17544-PoC
CVE-2026-17544 — PHP bcmath bccomp Out-of-Bounds-Write Stack-Smashing CVSS 9.8 Kritisch · CWE-787 · GHSA-x692-q9x7-8c3f Zusammenfassung bcstr2num in ext/bcmath/libbcmath/src/str2num.c mitgeliefertes libbcmath, PHP 8.4+ enthält einen Off-by-N-Out-of-Bounds-Write. Wenn die vom Benutzer angegebene...
PT-2026-109799
Name of the Vulnerable Software and Affected Versions DirectoryPress versions 3.x and earlier Description An unauthenticated Local File Inclusion issue exists, allowing an attacker to include files from the local file system without authentication. Recommendations Update DirectoryPress to a versi...
PT-2026-109589
Name of the Vulnerable Software and Affected Versions Axiomthemes Balance versions prior to 1.12.1 Description The Axiomthemes Balance WordPress theme contains a flaw where it deserializes untrusted user-controlled data using the unserialize function. This allows for PHP object injection, where...
PT-2026-109505
Name of the Vulnerable Software and Affected Versions Rank Math SEO versions prior to 1.0.280 Description The settings import feature fails to correctly validate the type of uploaded files. This allows users with administrator-level access to upload a PHP file, which can lead to remote code...
PT-2026-109792
Name of the Vulnerable Software and Affected Versions Angio versions prior to 1.1.2 Description PHP Object Injection occurs in the Subscriber component, allowing an attacker to inject malicious objects into the application. Recommendations Update to a version newer than 1.1.1...
CVE-2026-81797: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme = 1.0.2 versions...
CVE-2026-78535: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Photolia = 1.0.3 versions...
CVE-2026-78531: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Jacqueline = 2.22 versions...
CVE-2026-78533: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Qwery = 3.6.1 versions...
CVE-2026-66569: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Kicker = 2.2.1 versions...
CVE-2026-66568: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Original = 1.9.0 versions...
CVE-2026-66567: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Anesta = 1.5.3 versions...