CVE-2026-91827 Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another install...

CVE-2026-91827

The Ninja Forms WordPress plugin (version 3.15.3 ) is vulnerable to unauthenticated PHP Object Injection . User-submitted form field values are deserialised without sanitisation when an administrator exports form submissions to CSV . Exploitation requires user interaction (an admin performing the...

EUVD-2026-84283

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another install...

CVE-2026-91827 Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another install...

Exploit for CVE-2026-19658

CVE-2026-19658 — Give Tributes Unauthenticated PHP Object Inje...

CVE-2026-19658

The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...

CVE-2026-19658 Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter

The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...

CVE-2026-19658

Give Tributes WordPress plugin (≤ 2.3.1 ) is vulnerable to PHP Object Injection via deserialization of untrusted input in the give_tributes_ecard_notify[recipient][personalized][] parameter, exploitable by unauthenticated attackers. No known POP chain exists within the plugin itself, so impact de...

EUVD-2026-84269

The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...

CVE-2026-19658 Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter

The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...

PT-2026-96784

In MISP's UsersController login method, the pre-authentication database query used for the TOTP two-factor authentication verification branch did not include the User.disabled column in its SELECT fields list. The query selected only User.password, User.totp, and User.hotp counter. When the TOTP...

PT-2026-97033

Name of the Vulnerable Software and Affected Versions WuzhiCMS version 5.0.0 Description An unrestricted file upload issue exists in the thumbnail-upload endpoint '/index.php?m=member&f=article&v=thumbUpload'. An authenticated low-privileged member can upload a crafted .php file to execute...

PT-2026-96727

Name of the Vulnerable Software and Affected Versions php-file-manager-with-code-editor versions prior to 3.1 Description A flaw in the move uploaded file function within the filemanager.php file allows for unrestricted file upload. This issue can be exploited remotely by manipulating the files...

PT-2026-96763

Name of the Vulnerable Software and Affected Versions php-file-manager-with-code-editor versions prior to 3.1 Description An unrestricted file upload issue exists in the Save Handler component. A remote attacker can manipulate the filename and content arguments within the file put contents functi...

PT-2026-96645

Name of the Vulnerable Software and Affected Versions Give Tributes versions prior to 2.3.2 Description The Give Tributes plugin for WordPress is susceptible to PHP Object Injection through the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. The...

PT-2026-96677

Name of the Vulnerable Software and Affected Versions HUSKY – Products Filter for WooCommerce Professional versions prior to 1.4.5 Description The plugin is subject to Local File Inclusion, a condition where an application includes files from the local file system without proper validation...

PT-2026-96651

Name of the Vulnerable Software and Affected Versions Ninja Forms WordPress plugin version 3.15.3 Description An issue exists where user-submitted form field values are not prevented from being deserialized when an administrator exports form submissions to CSV. This allows unauthenticated attacke...

PT-2026-96921

Name of the Vulnerable Software and Affected Versions Softaculous Virtualizor versions prior to 3.2.9 Patch 9 Softaculous Virtualizor version 3.0.0 Description A PHP object injection issue exists in the billing module handler. Unauthenticated remote attackers can provide arbitrary serialized PHP...

CVE-2026-88419: Unrestricted Upload of File with Dangerous Type

An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint /index.php?m=member&f=article&v=thumbUpload of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server, because the stored file...

CVE-2026-87902: Improper Control of Filename for Include/Require Statement in PHP Program

An unauthenticated attacker can make getpagetemplate page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE...