CVE-2026-93771 WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Cost of Goods for WooCommerce = 3.5.2 versions...

CVE-2026-93651 WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Injection vulnerability

Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce = 2.1.2 versions...

CVE-2026-93651 WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Injection vulnerability

Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce = 2.1.2 versions...

EUVD-2026-89827

Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce = 2.1.2 versions...

CVE-2026-93651

The Minimum and Maximum Quantity for WooCommerce plugin for WordPress, version 2.1.2 and below , is vulnerable to a PHP Object Injection vulnerability. This flaw allows an attacker to perform object injection, potentially leading to significant impacts on confidentiality, integrity, and availabil...

CVE-2026-93624 WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...

EUVD-2026-89826

Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...

CVE-2026-93624 WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...

CVE-2026-93624

The Music Player for WooCommerce plugin for WordPress (versions

CVE-2025-26198

CVE-2025-26198 - SQL Injection Demonstration Academic project ENSIMAG - Security 3A Authors: Wail Yacoubi, Mohammed-Yassine Akhmari Date: January 2026 Warning This code is intentionally vulnerable for educational purposes. Never deploy in production. Description Reproduction of CVE-2025-26198:...

cve-2026-87902-wordpress-lfi-lab

CVE-2026-87902 / GHSA-7hp8-65ch-5whp — WordPress getpagetemplate unauthenticated LFI → conditional RCE Reproduction lab + URL-list scanner + PoC, built and validated end-to-end against genuine WordPress 7.1.1 vulnerable and 7.1.2 patched on the Docker lab. Advisory:...

OpenSTAManager_RCE_Exploit-CVE-2026-38751-

OpenSTAManager RCE Exploit CVE-2026-38751 Overview This Python script exploits a Remote Code Execution vulnerability in OpenSTAManager version 2.10, identified as CVE-2026-38751. The exploit allows authenticated users to upload a malicious module and execute arbitrary commands on the target syste...

tirreno

tirreno tirreno is open security analytics. tirreno tir.ˈrɛ.no helps understand, monitor, and protect your applications from cyber threats, account takeovers, bots, and abuse. While classic cybersecurity focuses on infrastructure and network perimeter, most breaches occur through compromised...

CVE-2017-5638-Apache-Struts2

CVE-2017-5638 Apache Struts2 Example PoC Exploit PHP Code for CVE-2017-5638 Usage php exploit.php "http://127.0.0.1:8080/example/index.action" "command" USE AT YOUR OWN RISK...

EUVD-2026-89654

The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssalocale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute...

CVE-2026-91051

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...

CVE-2026-75823

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...

EUVD-2026-89618

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...

CVE-2026-91051

The EWWW Image Optimizer WordPress plugin versions before 8.8.0 (specifically versions 8.6.0 - 8.7.7 ) is vulnerable to PHP Object Injection . Authenticated users with author-level permissions can store a serialized value in a post meta field (specifically 'eio_page_settings' ). When the post is ...

CVE-2026-91051 EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...