109861 matches found
EUVD-2026-76829
The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmwpostslocatorajaxinfowindowloader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the...
CVE-2026-85200 GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion
The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmwpostslocatorajaxinfowindowloader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the...
CVE-2026-82845
The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS...
CVE-2026-84099 IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php
The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further wh...
CVE-2026-84099
The wpstorecart WordPress plugin (versions
EUVD-2026-76794
The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further wh...
CVE-2026-84099 IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php
The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further wh...
EUVD-2026-76787
The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS...
EUVD-2026-76784
The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler, allowing unauthenticated attackers to upload arbitrary files, including PHP, to a web-accessible directory, which can lead to remote code...
CVE-2026-82845 Masteriyo LMS < 3.4.1 - Subscriber+ PHP Object Injection
The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS...
CVE-2026-82845
The Masteriyo LMS WordPress plugin (versions before 3.4.1 ) is vulnerable to PHP Object Injection due to the failure to prevent deserialization of user-supplied values held as metadata. An attacker with a minimal account can inject arbitrary PHP objects, leveraging a class in a bundled library to...
Exploit for Improper Access Control in Ollyo Helix3
CVE-2026-49049 This repository contains a Python-based scanne...
Linux Distros Unpatched Vulnerability : CVE-2024-58382
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service...
PT-2026-90570
The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS...
CVE-2026-78175: Deserialization of Untrusted Data
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the withdrawmethodfield parameter of the tutorsavewithdrawaccount AJAX handler. This is due to the handler lacking any capability or role...
CVE-2026-84099: Deserialization of Untrusted Data
The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further wh...
PT-2026-90578
Name of the Vulnerable Software and Affected Versions wpstorecart versions prior to 5.0.8 Description The plugin fails to prevent direct, unauthenticated access to a bundled add-on located at 'paypal.php' within the wpsc-membership-pro component. This allows unauthenticated attackers to inject...
CVE-2026-78006: Deserialization of Untrusted Data
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the issafewidgetinstance function. This is due to insufficient protection in issafewidgetinstance, which can be bypassed because PHP fires magic methods during its...
Fedora 45 : php-pecl-mongodb2 (2026-1576c48cce)
The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-1576c48cce advisory. Version 2.5.2 - PHPC-2744 Fix out-of-bounds read when building BSON field path by @paulinevos & @GromNaN in 2081 CVE-2026-84968 ---- Version 2.5.0 - Honor th...