110527 matches found
CVE-2026-40877
Combodo iTop , a web-based IT service management tool, is vulnerable to PHP object injection in its user preference functionality prior to version 3.2.3 , which can lead to remote code execution . The attack vector is network-based with low complexity and requires low privileges and user interact...
CVE-2026-40877
Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3...
CVE-2026-78416
Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interprete...
WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by 20kilograma in WordPress Plugin WP Project Manager versions = 4.0.6...
WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Udin Chan in WordPress Plugin The Events Calendar versions = 6.17.2...
WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability
WordPress ACPT Pro - Custom Post Types Plugin for WordPress plugin = 2.0.63 - PHP Object Injection vulnerability discovered by VDsec in WordPress Plugin ACPT Pro - Custom Post Types Plugin for WordPress versions = 2.0.63...
CVE-2026-66650
Unauthenticated PHP Object Injection in FreightCo = 1.1.15 versions...
WordPress BookingPress plugin < 1.5.6 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability discovered by Sanjar Tulkinov in WordPress Plugin BookingPress versions 1.5.6...
EUVD-2026-64809
Unauthenticated PHP Object Injection in FreightCo = 1.1.15 versions...
CVE-2026-66650 WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in FreightCo = 1.1.15 versions...
CVE-2026-66650 WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in FreightCo = 1.1.15 versions...
CVE-2026-66650
CVE-2026-66650 is an unauthenticated PHP Object Injection vulnerability in the WordPress theme FreightCo , affecting versions ≤ 1.1.15 . Discovered by daroo , it allows a remote, unauthenticated attacker to achieve full compromise (confidentiality, integrity, and availability), rated CVSS 9.8 (CR...
PT-2026-80842
Unauthenticated PHP Object Injection in FreightCo = 1.1.15 versions...
PT-2026-81058
Name of the Vulnerable Software and Affected Versions The Events Calendar versions prior to 6.17.3 Description An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the PHP unserialize function, potentially allowing an attacker to...
PT-2026-81055
Unauthenticated PHP Object Injection in WP Project Manager = 4.0.6 versions...
CVE-2026-78416: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interprete...
CVE-2026-78262: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in WP Project Manager = 4.0.6 versions...
CVE-2026-32563: Deserialization of Untrusted Data
Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
CVE-2026-32560: Improper Control of Filename for Include/Require Statement in PHP Program
Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator = 1.4 versions...