113689 matches found
CVE-2026-39532: Deserialization of Untrusted Data
Contributor PHP Object Injection in Events Calendar for GeoDirectory = 2.3.25 versions...
CVE-2026-38329
Bludit CMS versions prior to 3.18.4 are vulnerable to Remote Code Execution (RCE) within the API Plugin . The issue resides in the bl-plugins/api/plugin.php file, where the POST /api/files/{key} endpoint fails to perform adequate authorization checks and lacks file extension validation . Conseque...
CVE-2026-48157: Improper Neutralization of Input During Web Page Generation
Slim is a PHP micro framework that enables users to write simple web applications and APIs. In versions 4.4.0 through 4.15, if an application uses HttpException::setTitle and/or setDescription to include untrusted/request-derived data in the error title or description e.g. "No products found...
CVE-2026-9691: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms = 1.1.1 versions...
CVE-2026-49765: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms = 1.1.8 versions...
CVE-2026-49109: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms = 1.4.3 versions...
CVE-2026-49106: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact = 1.1.6 versions...
CVE-2026-49104: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms = 1.2.1 versions...
CVE-2026-39471: Deserialization of Untrusted Data
Author PHP Object Injection in ShortPixel Image Optimizer = 6.4.3 versions...
PT-2026-49297
Bludit CMS before version 3.18.4 allows Remote Code Execution RCE via the API Plugin. The POST /api/files/key endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation. An attacker with a valid API token can upload a malicious PHP script and...
PT-2026-49212
WordPress Lazy Content Slider Plugin 3.4 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting malicious HTML forms. Attackers can trick authenticated administrators into submitting POST requests to the plugin settings page via lzcs...
PT-2026-49217
WordPress Dharma Booking 2.28.3 and earlier contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the gateway parameter. Attackers can supply file paths with directory traversal sequences or null byte injection to the gatewa...
CVE-2026-39474: Deserialization of Untrusted Data
Contributor PHP Object Injection in Post Duplicator = 3.0.10 versions...
CVE-2026-27053: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Broadcast Live Video 7.1.3 versions...
CVE-2016-20075: Incorrect Authorization
WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or administrator roles to upload malicious files by exploiting the custom fields functionality. Attackers can upload PHP shells through the...
PT-2026-49507
Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms = 1.1.4 versions...
VulnCheck KEV: CVE-2026-48908
JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code...
CVE-2026-49763: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot = 1.3.7 versions...