112987 matches found
CVE-2026-12256: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection.This issue affects Fusion Builder: from n/a through 3.15.3...
CVE-2025-69162: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Grecko = 5.17 versions...
CVE-2025-69146: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Dom = 1.24 versions...
CVE-2025-69122: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in SeaFood Company = 1.4 versions...
CVE-2025-69108: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Hot Coffee = 1.7 versions...
CVE-2025-60205: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trxaddons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1...
WordPress Theme: joly: CVE-2025-58953: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Unauthenticated Local File Inclusion in Joly = 1.22.0 versions...
WordPress Theme: neuronet: CVE-2025-58952: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Unauthenticated Local File Inclusion in Neuronet 1.14.0 versions...
CVE-2026-39557: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in NeoBeat = 1.7 versions...
PT-2026-50409
Unauthenticated PHP Object Injection in Moderno 1.43 versions...
CVE-2026-27429: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Nifty = 1.4.1 versions...
CVE-2026-49075: Deserialization of Untrusted Data
Contributor PHP Object Injection in JetEngine = 3.8.9.1 versions...
WordPress Theme: homeroofer: CVE-2025-58954: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Unauthenticated Local File Inclusion in HomeRoofer = 2.11.0 versions...
CVE-2026-12115: Deserialization of Untrusted Data
The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level...
CVE-2026-48820: Improper Control of Filename for Include/Require Statement in PHP Program
CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::getElementFileName does not check that the resolved element path is within the application/plugin view template paths...
CVE-2026-40759: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Esmée = 1.4 versions...
CVE-2025-69158: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Granola = 1.13 versions...
Drupal core - Critical - PHP object injection - SA-CORE-2026-005
SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web services. The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially inject a malicious payload in certain...
Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048
The Formatter Field module provides a mechanism for specifying a formatter and formatter settings to be used for displaying a field, on a per-entity basis. formatterfield stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can...