111780 matches found
CentOS Linux 8.4 [TuxCare] Security Update: php / php-dba / php-devel / php-enchant / php-fpm / php-gd / etc (CENTOS8.4:CLSA-2025:1744782851)
The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2025:1744782851 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...
PT-2026-103171
Editor PHP Object Injection in Responsive Slider Gallery = 1.5.5 versions...
PT-2026-103170
Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer = 2.33.6 versions...
PT-2026-103242
Name of the Vulnerable Software and Affected Versions ShortPixel Image Optimizer versions prior to 6.5.6 Description ShortPixel Image Optimizer contains a flaw involving the deserialization of untrusted data, which allows Object Injection. Object Injection occurs when an application deserializes ...
CVE-2026-97248: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Booking Activities = 1.18.7.1 versions...
CVE-2026-97246: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Object Injection.This issue affects ShortPixel Image Optimizer: from n/a through 6.5.5...
CVE-2026-96833: Deserialization of Untrusted Data
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 = 3.5.51 versions...
CVE-2026-96831: Deserialization of Untrusted Data
Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...
PT-2026-103244
Unauthenticated PHP Object Injection in Booking Activities = 1.18.7.1 versions...
CVE-2026-103592: Use of Less Trusted Source
simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. Attackers can spoof X-Forwarded-For, CF-Connecting-IP, or Client-IP headers to...
CVE-2026-97291: Deserialization of Untrusted Data
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...
CVE-2026-102392: Deserialization of Untrusted Data
Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...
CVE-2026-100512: Deserialization of Untrusted Data
Contributor PHP Object Injection in Nested Pages = 3.3.2 versions...
CVE-2026-93771: Deserialization of Untrusted Data
Shop manager PHP Object Injection in Cost of Goods for WooCommerce = 3.5.2 versions...
CVE-2026-93651: Deserialization of Untrusted Data
Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce = 2.1.2 versions...
CVE-2026-93624: Deserialization of Untrusted Data
Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...
CVE-2026-103229: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqliquery of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a manipulation of the argument ID results i...
CVE-2026-102427: Unrestricted Upload of File with Dangerous Type
Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing task=getContent, a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates th...