111933 matches found
CVE-2026-49107: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Thrive Apprentice 10.8.10.2 versions...
Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048
The Formatter Field module provides a mechanism for specifying a formatter and formatter settings to be used for displaying a field, on a per-entity basis. formatterfield stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can...
Drupal core - Critical - PHP object injection - SA-CORE-2026-005
SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web services. The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially inject a malicious payload in certain...
CVE-2025-69127: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Plumbing = 1.6 versions...
CVE-2026-39568: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Mr. SEO = 2.0 versions...
CVE-2026-40760: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Behold = 1.5 versions...
CVE-2025-69111: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Reisen = 1.4.1 versions...
CVE-2026-40752: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Manufaktur Solutions = 1.1.1 versions...
PT-2026-50305
Unauthenticated PHP Object Injection in Mildhill = 1.5 versions...
CVE-2026-40754: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Roisin = 1.4 versions...
CVE-2025-69162: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Grecko = 5.17 versions...
CVE-2025-69158: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Granola = 1.13 versions...
CVE-2026-27429: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Nifty = 1.4.1 versions...
PT-2026-50531
Name of the Vulnerable Software and Affected Versions Pimcore CMS/DXP version 12.3.8 Description A sandbox bypass allows authenticated administrative attackers to execute arbitrary methods on PHP objects. This occurs due to empty checkMethodAllowed and checkPropertyAllowed implementations within...
CVE-2026-39567: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Santé = 1.5.1 versions...
CVE-2026-39445: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Alukas 3.0.0 versions...
CVE-2026-39443: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in EmallShop = 2.4.21 versions...
CVE-2026-39446: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Kapee 1.7.0 versions...