110396 matches found
PT-2026-76897
A weakness has been identified in PHPGurukul Complaint Management System 1.0. Affected by this issue is some unknown functionality of the file user/check availability.php. This manipulation of the argument email causes sql injection. Remote exploitation of the attack is possible. The exploit has...
PT-2026-77086
Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...
PT-2026-77047
Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...
EUVD-2026-61091
An incorrect access control vulnerability in reportico-web = 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safemode setting leading to remote code execution...
CVE-2026-74012: Deserialization of Untrusted Data
Editor PHP Object Injection in TaxoPress = 3.51.0 versions...
CVE-2026-73341: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...
CVE-2026-73380: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...
CVE-2026-32470: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...
CVE-2026-52608: Improper Access Control
An incorrect access control vulnerability in reportico-web = 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safemode setting leading to remote code execution...
EUVD-2026-61097
A directory traversal vulnerability in reportico-web = 8.1.0 allows remote attackers to expose or execute arbitrary php files on the web server by specifying the filename in the targetformat parameter in conjunction with the executemode=EXECUTE parameter of the run.php endpoint...
PT-2026-77056
Name of the Vulnerable Software and Affected Versions OptionTree versions prior to 2.7.4 Description PHP Object Injection occurs when untrusted data is passed to the unserialize function, allowing an attacker to manipulate serialized objects and potentially execute arbitrary code. Recommendations...
CVE-2026-66620: Deserialization of Untrusted Data
Editor PHP Object Injection in OptionTree = 2.7.3 versions...
CVE-2026-52608
The software reportico-web (version
CVE-2026-73376: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic 1.5.0 versions...
PT-2026-77103
Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...
CVE-2026-32465: Deserialization of Untrusted Data
Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...
PT-2026-77102
Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...
CVE-2026-52608
An incorrect access control vulnerability in reportico-web = 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safemode setting leading to remote code execution...
PT-2026-77179
MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=do emailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when t...