PT-2026-109820

Name of the Vulnerable Software and Affected Versions Kalles versions prior to 1.1.7.2 Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious objects into the application without...

PT-2026-109580

Name of the Vulnerable Software and Affected Versions Let's Play versions prior to 1.1.16 Description Deserialization of untrusted data in the playhockey component allows Object Injection. Object Injection occurs when untrusted data is used to abuse the logic of an application by injecting...

CVE-2026-96648: Improper Neutralization of Input During Web Page Generation

The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action in all versions up to, and including, 1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-87869: Improper Neutralization of Input During Web Page Generation

The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.9.6. This is due to insufficient input sanitization and output escaping in the flrtelementorloadmoreanchor function. The function reads...

CVE-2026-108629: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to modify department data rules. Low-privileged attackers can send departId, permissionId and dataRuleIds to POST...

CVE-2026-62044: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13...

CVE-2026-108627: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/permissionId/roleId to read rule names, columns, conditions,...

PT-2026-109857

Name of the Vulnerable Software and Affected Versions Alliance versions prior to 3.12 Description An unauthenticated PHP Object Injection issue exists, which occurs during the deserialization of untrusted data. This allows an attacker to inject malicious objects into the application without...

PT-2026-109810

Name of the Vulnerable Software and Affected Versions Yacht Rental versions 2.6 and earlier Description An unauthenticated PHP Object Injection issue exists, which occurs during the deserialization of untrusted data. This allows an attacker to inject malicious objects into the application without...

PT-2026-109587

Name of the Vulnerable Software and Affected Versions Convex versions prior to 1.16.1 Description ThemeREX Group Convex is subject to a deserialization of untrusted data issue that allows PHP Object Injection. This occurs when the application deserializes data from an untrusted source without...

PT-2026-109861

Name of the Vulnerable Software and Affected Versions Qwery versions prior to 3.6.2 Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the application...

PT-2026-109855

Name of the Vulnerable Software and Affected Versions Original versions prior to 1.9.1 Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the application...

PT-2026-109762

Name of the Vulnerable Software and Affected Versions Swish Migrate and Backup versions prior to 1.4.1 Description An issue exists that allows unauthenticated users to access sensitive data. Recommendations Update to a version newer than 1.4.0...

PT-2026-109585

Name of the Vulnerable Software and Affected Versions Edema versions prior to 1.2.2.3 Description Deserialization of untrusted data in the ThemeREX Group Edema theme allows for Object Injection. Object Injection occurs when untrusted input is passed to a deserialization function, potentially...

PT-2026-109901

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the queryById handler of the SysDepartRoleController. The issue stems from the absence of Shiro permission annotations, which are used to enforce access control. Thi...

PT-2026-109852

Name of the Vulnerable Software and Affected Versions FC United versions prior to 1.1.2 Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the application...

PT-2026-109808

Name of the Vulnerable Software and Affected Versions Tipsy versions 1.6 and earlier Description An unauthenticated PHP Object Injection issue exists, which occurs during the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the application...

PT-2026-109841

Name of the Vulnerable Software and Affected Versions N7 | Golf Club Sports & Events versions prior to 2.21 Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the...

PT-2026-109703

Name of the Vulnerable Software and Affected Versions Super Video Player versions prior to 1.8.14 Description Deserialization of untrusted data in the bPlugins Super Video Player plugin allows for Object Injection. This occurs when the application deserializes data from an untrusted source withou...

PT-2026-109573

Name of the Vulnerable Software and Affected Versions Veto versions prior to 1.6.0 Description Deserialization of untrusted data in Veto allows Object Injection, a technique where an attacker can manipulate serialized objects to execute arbitrary code or interfere with application logic...