113675 matches found
CVE-2026-48820: Improper Control of Filename for Include/Require Statement in PHP Program
CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::getElementFileName does not check that the resolved element path is within the application/plugin view template paths...
CVE-2026-40733: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in ShiftUp = 1.3 versions...
CVE-2026-39442: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in PressMart = 1.2.26 versions...
CVE-2026-49075: Deserialization of Untrusted Data
Contributor PHP Object Injection in JetEngine = 3.8.9.1 versions...
CVE-2026-40760: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Behold = 1.5 versions...
CVE-2026-40759: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Esmée = 1.4 versions...
CVE-2026-40758: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Léonie = 1.2.1 versions...
CVE-2026-40754: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Roisin = 1.4 versions...
CVE-2026-40735: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Reina = 2.1 versions...
CVE-2026-40725: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in WooCommerce Product Filters 2.0.6 versions...
CVE-2026-39580: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Micdrop = 1.3.1 versions...
CVE-2026-39568: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Mr. SEO = 2.0 versions...
CVE-2026-39545: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Zermatt = 1.6.1 versions...
CVE-2025-69146: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Dom = 1.24 versions...
CVE-2025-69122: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in SeaFood Company = 1.4 versions...
CVE-2025-60205: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trxaddons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1...
WordPress Theme: neuronet: CVE-2025-58952: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Unauthenticated Local File Inclusion in Neuronet 1.14.0 versions...
PT-2026-50400
Unauthenticated PHP Object Injection in Hiroshi = 1.5.1 versions...
PT-2026-50606
Name of the Vulnerable Software and Affected Versions Drupal core affected versions not specified Description An attacker with appropriate JSON:API write permissions could potentially inject a malicious payload in certain rare circumstances, leading to PHP Object Injection. PHP Object Injection...