CVE-2023-6654

CVE-2023-6654 PHPEMS Cookie デシリアライゼーション脆弱性。この脆弱性を利用して、デシリアライゼーションによりSQL文を改変し、SQLインジェクションを通じて既存ユーザーのパスワードや権限を任意に変更できます。デフォルトの管理者アカウントは peadmin です。 Fofa フィンガープリント app="PHPEMS" ツールの使用方法 python exp.py -u http://127.0.0.1:1111 -u パラメータでPHPEMSのURLアドレスを指定します -a パラメータでユーザー名を指定します。デフォルトはPHPEMSの管理アカウント...

DotNetNuke 9.2 - 9.2.2 - Weak Encryption & Cookie Deserialization

DNN DotNetNuke versions 9.2 through 9.2.2 use a weak encryption algorithm to protect input parameters because of an incomplete fix for CVE-2018-15811. This cryptographic weakness enables attackers to craft malicious DNNPersonalization cookies that can be deserialized, leading to remote code...

DotNetNuke 9.2 - 9.2.1 - Weak Encryption & Cookie Deserialization

DNN DotNetNuke versions 9.2 through 9.2.1 use a weak encryption algorithm to protect input parameters. This cryptographic weakness enables attackers to craft malicious DNNPersonalization cookies that can be deserialized, leading to remote code execution. id: CVE-2018-15811 info: name: DotNetNuke...

gitlab-cve-2020-10977

GitLab CVE2020-10977 简介 该脚本可针对 GitLab 社区版（CE）和企业版（EE）实现远程代码执行。该 CVE 是一个任意文件读取漏洞，通过下载 GitLab 的 secrets.yaml 文件，可以提取 Rails 的 secretkeybase。进而，你可以通过签名 GitLab 内部用于 A/B 测试的 experimentationsubjectid cookie 来获得代码执行能力。cookie 中嵌入的 payload 包含一个反序列化漏洞，允许在 GitLab 实例上运行代码。 任意文件读取漏洞存在于 GitLab EE/CE 8.5...

CVE-2026-77138 Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)

The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server...

EUVD-2026-65338

The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server...

Telerik UI for ASP.NET AJAX < 2026.2.708 Multiple Vulnerabilities

The version of Telerik UI for ASP.NET AJAX installed on the remote Windows host is prior to 2026.2.708. It is, therefore, affected by multiple vulnerabilities: - In Progress Telerik UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout...

CVE-2026-13185

In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code execution...

CVE-2026-13185

CVE-2026-13185 affects Progress Telerik UI for ASP.NET AJAX (prior to 2026.2.708). The vulnerability arises when cookie-based storage (RadPersistenceManager or RadDockLayout) deserializes attacker-controlled cookie content, enabling unauthenticated remote code execution. Affected product/version:...

CVE-2026-13185 PersistenceFramework Cookie Deserialization Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code execution...

CVE-2026-13185 PersistenceFramework Cookie Deserialization Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code execution...

PT-2026-63399

Name of the Vulnerable Software and Affected Versions Telerik UI for AJAX versions prior to 2026.2.708 Description Applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, which allows unauthenticated remote code execution...

Exploit for CVE-2026-48909

CVE-2026-48909 — SP LMS PHP Object Injection → RCE !CVEht...

CVE-2026-48909 Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla < 4.1.4

SP LMS comsplms 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server...

CVE-2026-48909

SP LMS comsplms 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server...

PT-2026-51136

Name of the Vulnerable Software and Affected Versions SP LMS versions prior to 4.1.4 Description SP LMS com splms by JoomShaper contains a PHP Object injection flaw where user-controlled cookie data is deserialized without validation. Specifically, the application passes the lmsOrders cookie to a...

CVE-2026-7637

The Boost plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.3 via deserialization of untrusted input in the STYXKEY-BOOSTUSERLOCATION cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present i...

CVE-2026-44501 DataHub OIDC REDIRECT_URL Cookie Deserialization Vulnerability

DataHub is an open-source metadata platform. Prior to 1.5.0.3, The DataHub frontend datahub-frontend-react deserializes attacker-controlled Java objects from the REDIRECTURL HTTP cookie during the OIDC callback flow, with no integrity protection no HMAC, no encryption. This is a Deserialization o...

CVE-2014-125112

The Plack::Middleware::Session::Cookie Perl component, versions through 0.21 , is vulnerable to remote code execution (RCE) . The root cause is the lack of a secret key to sign cookie data during the deserialization process, allowing an attacker to execute arbitrary code on the server. While spec...

CVE-2014-125112

Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution. Plack::Middleware::Session::Cookie versions through 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server during deserialization of the cookie data, when...