110435 matches found
WordPress Agora theme <= 1.9 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Agora versions = 1.9...
WordPress Advice theme <= 1.18.0 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Advice versions = 1.18.0...
WordPress Abogado theme <= 1.18 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Abogado versions = 1.18...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection via filename handling in the Gitblame, Hgblame, and Svnblame report generators. An attacker can execute arbitrary shell commands by supplying an untrusted file whose name contains shell metacharacters. When...
CVE-2026-19021 SourceCodester Computer Repair Shop Management System Master.php delete_product sql injection
A security vulnerability has been detected in SourceCodester Computer Repair Shop Management System 1.0. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=deleteproduct. Such manipulation of the argument ID leads to sql injection. It is possible to launch the...
EUVD-2026-53825
A security vulnerability has been detected in SourceCodester Computer Repair Shop Management System 1.0. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=deleteproduct. Such manipulation of the argument ID leads to sql injection. It is possible to launch the...
PT-2026-68565
Name of the Vulnerable Software and Affected Versions Adrena versions prior to 1.2.15 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadget...
CVE-2026-65572: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in A.Williams = 1.3.1 versions...
PT-2026-68561
Name of the Vulnerable Software and Affected Versions A.Williams versions prior to 1.3.2 Description The A.Williams plugin for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. This issue occurs when the application processe...
CVE-2026-65549: Deserialization of Untrusted Data
Author PHP Object Injection in Jeg Kit for Elementor = 3.2.10 versions...
PT-2026-68563
Name of the Vulnerable Software and Affected Versions Abogado versions prior to 1.19 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. While no POP chain a sequence of gadgets used t...
PT-2026-68569
Name of the Vulnerable Software and Affected Versions AI ANN versions prior to 1.29.1 Description The AI ANN - AI Generator & AI Agency WordPress Theme is subject to PHP Object Injection due to the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object...
CVE-2026-65581: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in AI ANN = 1.29.0 versions...
CVE-2026-71478: Improper Neutralization of Input During Web Page Generation
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a...
PT-2026-68774
Impact PHP CodeSniffer versions before v3.13.6 and v4.0.2 contain a command injection vulnerability in the code creating the Gitblame, Hgblame and Svnblame reports. As a result, running PHP CodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer...
PT-2026-68964
Impact PHP CodeSniffer versions before v3.13.6 and v4.0.2 contain a command injection vulnerability in the code creating the Gitblame, Hgblame and Svnblame reports. As a result, running PHP CodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer...
CVE-2026-65556: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in WPBruiser no- Captcha anti-Spam = 3.1.43 versions...
CVE-2026-65578: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Agora = 1.9 versions...