RedTeamBrasil-CVE-2025-64459

connector-sqli Автоматизированная эксплуатация SQL-инъекции в ORM Django Q-object connector · CVE-2025-64459 🎥 канал RedTeam Brasil — практическая безопасность на португальском. ██████╗ ████████╗██████╗ connector-sqli ██╔══██╗╚══██╔══╝██╔══██╗ Django Q connector SQLi ██████╔╝ ██║ ██████╔╝...

CVE-2026-34213

CVE-2026-34213 Un utilisateur Docmost à faibles privilèges pourrait fournir un attachmentId victime au point de terminaison de téléversement générique et écraser la pièce jointe stockée d'une autre page dans le même espace de travail. Introduction J'ai identifié, divulgué de manière responsable e...

Qlik-View-12.60-Including-SR-Stored-Cross-Site-Scripting-CVE-2022-42248

QlikView = 12.60 включая SR Межсайтовый скриптинг с сохранением CVE-2022-42248 Содержание 1. Обзор 2. Подробное описание 3. Подтверждение концепции 4. Решение 5. График раскрытия 6. Ссылки 7. Авторы 8. Правовая информация Обзор Редакция: 1.0 Воздействие: Межсайтовый скриптинг с сохранением в...

CVE-2026-104905

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData that allows authenticated attackers to trigger unserialize on raw POST data without an allowedclasses filter for multiple-select fields. Attackers can submit a serialized XLSXWriter...

CVE-2026-14871

CVE-2026-14871 - BOLA / IDOR в osTicket ajax.tickets.php Нарушение авторизации на уровне объектов BOLA: Небезопасная прямая ссылка на объект IDOR include/ajax.tickets.php → функция viewField Сообщено @JF0x0r · 27 марта 2026 Статус: ИСПРАВЛЕНО - исправление выпущено в osTicket v1.17.8 / v1.18.4...

CVE-2026-103349

The Product Feed PRO for WooCommerce plugin (versions ≤ 13.5.7 ) by Rymera Web Co is vulnerable to PHP Object Injection due to the Deserialization of Untrusted Data (CWE-502). This flaw allows an attacker to inject objects into the application. While the CVSS 3.1 score is 7.2 (High) , the attack ...

EUVD-2026-92593

Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7...

CVE-2026-103349 WordPress Product Feed PRO for WooCommerce plugin <= 13.5.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7...

CVE-2026-97283 WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5...

EUVD-2026-92590

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5...

CVE-2026-97283

The Advanced Post Manager plugin for WordPress (versions ≤ 4.5.5 ) is susceptible to a PHP Object Injection vulnerability caused by the deserialization of untrusted data . This flaw allows an attacker to inject objects, potentially leading to unauthorized actions. No specific remediation steps or...

EUVD-2026-92525

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData that allows authenticated attackers to trigger unserialize on raw POST data without an allowedclasses filter for multiple-select fields. Attackers can submit a serialized XLSXWriter...

CVE-2026-104905 FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData that allows authenticated attackers to trigger unserialize on raw POST data without an allowedclasses filter for multiple-select fields. Attackers can submit a serialized XLSXWriter...

CVE-2026-104905 FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData that allows authenticated attackers to trigger unserialize on raw POST data without an allowedclasses filter for multiple-select fields. Attackers can submit a serialized XLSXWriter...

CVE-2026-104905

FacturaScripts versions prior to 2026.7 are vulnerable to a PHP object injection vulnerability within the WidgetSelect::processFormData() function. The root cause is the application's failure to apply an allowed_classes filter when calling unserialize() on raw POST data for multiple-select fields...

CVE-2024-8353-PoC

Code de preuve de concept pour CVE-2024-8353 Ce dépôt contient un script pour exploiter la vulnérabilité CVE-2024-8353 dans le plugin GiveWP pour WordPress. Cette vulnérabilité permet une injection d'objets PHP non authentifiée, pouvant conduire à une exécution de code à distance. Aperçu Les...

CVE-2026-49104-

CVE-2026-49104- CVE-2026-49104 Intégration pour Keap/Infusionsoft Exploit d'injection d'objets PHP...

CVE-2026-49105

CVE-2026-49105 CVE-2026-49105 WP Zendesk PHP Object Injection Exploit...

CVE-2026-43499-RMX5200

CVE-2026-43499 pour realme RMX5200 CVE-2026-43499 élévation de privilèges locale SO pour : Élément| Valeur ---|--- Appareil| realme RMX5200 / RE6030L1 Android| 16 Noyau| 6.12.23-android16-5-gb2a876903b49-ab14541642-4k Empreinte| realme/RMX5200/RE6030L1:16/BP2A.250605.015/...:user/release-keys...

ruby-RCE-CVE-2019-5420-

Десериализация Ruby CVE-2019-5420 https://github.com/PenTestical/CVE-2019-5420 Ссылки: 1 Процесс реализации полезной нагрузки для выполнения команд в Ruby on Rails https://hackerone.com/reports/473888 Поскольку ActiveSupport::MessageVerifier и ActiveSupport::MessageEncryptor используют Marshal в...