111925 matches found
PT-2026-90570
The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS...
PT-2026-90578
Name of the Vulnerable Software and Affected Versions wpstorecart versions prior to 5.0.8 Description The plugin fails to prevent direct, unauthenticated access to a bundled add-on located at 'paypal.php' within the wpsc-membership-pro component. This allows unauthenticated attackers to inject...
web-vulnerabilities-demo
Web Security — Five Common Vulnerabilities A hands-on project...
CVE-2024-25600
Exploit de CVE-2024-25600 - WordPress Bricks Builder Ejecución Remota de Código RCE Un script de exploit para CVE-2024-25600 , una vulnerabilidad crítica de Ejecución Remota de Código RCE sin autenticación en el plugin Bricks Builder para WordPress. Esta herramienta detecta la falla, extrae el...
WordPress The Events Calendar plugin <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution vulnerability
Unauthenticated PHP Object Injection to Remote Code Execution vulnerability discovered by Chloe Chamberland, Wordfence Argus in WordPress Plugin The Events Calendar versions = 6.17.4...
CVE-2026-79362
Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...
CVE-2026-62103
Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...
CVE-2026-62107
Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...
CVE-2026-62105
Unauthenticated PHP Object Injection in ThemeREX Addons 2.45.0 versions...
[SECURITY] Fedora 45 Update: composer-2.10.3-1.fc45
Composer helps you declare, manage and install dependencies of PHP projects, ensuring you have the right stack everywhere. Documentation: https://getcomposer.org/doc/...
CVE-2026-62107 WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...
EUVD-2026-76212
Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...
CVE-2026-62107 WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...
CVE-2026-62107
Masteriyo – LMS is a WordPress LMS plugin affected by an unauthenticated PHP Object Injection vulnerability in versions ≤ 3.4.0 . The flaw allows an attacker to inject a malicious serialized PHP object, potentially leading to full compromise of the site. The Patchstack CVSS 3.1 score is 8.8 (HIGH...
CVE-2026-62103
CVE-2026-62103 affects the WordPress Everest Forms plugin in versions 3.6.0 and earlier . The vulnerability is an unauthenticated PHP Object Injection , rated CVSS 9.8 (Critical) by Patchstack, with high impact on confidentiality, integrity, and availability. No user interaction is required. A si...
EUVD-2026-76197
Unauthenticated PHP Object Injection in ThemeREX Addons 2.45.0 versions...
CVE-2026-62105 WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in ThemeREX Addons 2.45.0 versions...
CVE-2026-62105 WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in ThemeREX Addons 2.45.0 versions...