CVE-2026-108627: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/permissionId/roleId to read rule names, columns, conditions,...

PT-2026-109857

Name of the Vulnerable Software and Affected Versions Alliance versions prior to 3.12 Description An unauthenticated PHP Object Injection issue exists, which occurs during the deserialization of untrusted data. This allows an attacker to inject malicious objects into the application without...

PT-2026-109810

Name of the Vulnerable Software and Affected Versions Yacht Rental versions 2.6 and earlier Description An unauthenticated PHP Object Injection issue exists, which occurs during the deserialization of untrusted data. This allows an attacker to inject malicious objects into the application without...

PT-2026-109587

Name of the Vulnerable Software and Affected Versions Convex versions prior to 1.16.1 Description ThemeREX Group Convex is subject to a deserialization of untrusted data issue that allows PHP Object Injection. This occurs when the application deserializes data from an untrusted source without...

PT-2026-109861

Name of the Vulnerable Software and Affected Versions Qwery versions prior to 3.6.2 Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the application...

PT-2026-109855

Name of the Vulnerable Software and Affected Versions Original versions prior to 1.9.1 Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the application...

PT-2026-109762

Name of the Vulnerable Software and Affected Versions Swish Migrate and Backup versions prior to 1.4.1 Description An issue exists that allows unauthenticated users to access sensitive data. Recommendations Update to a version newer than 1.4.0...

PT-2026-109875

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the exportXls handler within the AiragExtDataController. This issue allows any authenticated user, including those with low privileges, to export AI evaluator data. ...

PT-2026-109582

Name of the Vulnerable Software and Affected Versions Hygia versions prior to 1.21.0 Description Deserialization of untrusted data in the software allows Object Injection, a technique where an attacker can manipulate serialized objects to execute arbitrary code or interfere with application logic...

PT-2026-109585

Name of the Vulnerable Software and Affected Versions Edema versions prior to 1.2.2.3 Description Deserialization of untrusted data in the ThemeREX Group Edema theme allows for Object Injection. Object Injection occurs when untrusted input is passed to a deserialization function, potentially...

PT-2026-109901

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the queryById handler of the SysDepartRoleController. The issue stems from the absence of Shiro permission annotations, which are used to enforce access control. Thi...

PT-2026-109852

Name of the Vulnerable Software and Affected Versions FC United versions prior to 1.1.2 Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the application...

PT-2026-109808

Name of the Vulnerable Software and Affected Versions Tipsy versions 1.6 and earlier Description An unauthenticated PHP Object Injection issue exists, which occurs during the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the application...

PT-2026-109841

Name of the Vulnerable Software and Affected Versions N7 | Golf Club Sports & Events versions prior to 2.21 Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the...

PT-2026-109703

Name of the Vulnerable Software and Affected Versions Super Video Player versions prior to 1.8.14 Description Deserialization of untrusted data in the bPlugins Super Video Player plugin allows for Object Injection. This occurs when the application deserializes data from an untrusted source withou...

PT-2026-109781

Name of the Vulnerable Software and Affected Versions Booster for WooCommerce versions prior to 8.4.1 Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the...

PT-2026-109573

Name of the Vulnerable Software and Affected Versions Veto versions prior to 1.6.0 Description Deserialization of untrusted data in Veto allows Object Injection, a technique where an attacker can manipulate serialized objects to execute arbitrary code or interfere with application logic...

PT-2026-109784

Name of the Vulnerable Software and Affected Versions CleanSkin versions 1.5.0 and earlier Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the application...

PT-2026-109576

Name of the Vulnerable Software and Affected Versions Smash versions prior to 1.12.0 Description ThemeREX Group Smash is subject to a deserialization of untrusted data issue that allows Object Injection. Object Injection occurs when untrusted data is used to abuse the logic of an application by...

PT-2026-109849

Name of the Vulnerable Software and Affected Versions Education Center versions prior to 3.6.13 Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the application...