113098 matches found
WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by nh4tvd in WordPress Plugin ThemeREX Addons versions 2.45.0...
WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by LueRader in WordPress Plugin Everest Forms versions = 3.6.0...
WordPress Site Reviews plugin 7.2.2-8.2.2 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability discovered by Jakub Herman in WordPress Plugin Site Reviews versions 7.2.2-8.2.2...
WordPress Weaver Show Posts plugin < 1.8.1 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Do Xuan Trung in WordPress Plugin Weaver Show Posts versions 1.8.1...
CVE-2026-14560 Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server...
AZL-101766 CVE-2026-89161 affecting package php 8.3.33-1
In PCRE2 before 10.48, pcre2jitmatch mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur...
AZL-101760 CVE-2026-89157 affecting package php 8.3.33-1
PCRE2 before 10.48, on 32-bit platforms, has a pcre2patternconvert out-of-bounds write when an attacker can provide a large pattern...
CVE-2026-79362: Improper Control of Generation of Code
Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...
CVE-2026-62107: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...
CVE-2026-62103: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...
CVE-2026-14560: Improper Control of Generation of Code
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server...
CVE-2026-79362
Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...
CVE-2026-79362
Certain Woltlab products are vulnerable to Remote Code Execution (RCE) via Cache Poisoning in the WCF component. The vulnerability affects versions WCF >= 6.1.0 until = 6.2.0 until
PT-2026-90023
Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...
PT-2026-90021
Unauthenticated PHP Object Injection in ThemeREX Addons 2.45.0 versions...
PT-2026-90598
Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.8 Description The Tutor LMS plugin for WordPress is affected by a PHP Object Injection issue that can lead to remote code execution on over 100,000 sites worldwide. The flaw exists in the tutor save withdraw...
CVE-2026-79362
Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...
CVE-2026-79362
Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...
PT-2026-90020
Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...
EUVD-2026-76188
Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...