44229 matches found
CVE-2026-56095 Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
The extension's indexer passed every field value returned by content object rendering through PHP's unserialize function when transferring multi-value data for the SOLRCLASSIFICATION, SOLRMULTIVALUE and SOLRRELATION content object types, rather than a safe format. If user-generated content saved ...
CVE-2026-56095
The Apache Solr for TYPO3 – Enterprise Search (solr) extension is affected by an insecure deserialization flaw in its indexer. When transferring multi-value data for the SOLR_CLASSIFICATION , SOLR_MULTIVALUE , and SOLR_RELATION content object types, every field value returned by content object re...
CVE-2026-56095
The extension's indexer passed every field value returned by content object rendering through PHP's unserialize function when transferring multi-value data for the SOLRCLASSIFICATION, SOLRMULTIVALUE and SOLRRELATION content object types, rather than a safe format. If user-generated content saved ...
EUVD-2026-65350
The extension's indexer passed every field value returned by content object rendering through PHP's unserialize function when transferring multi-value data for the SOLRCLASSIFICATION, SOLRMULTIVALUE and SOLRRELATION content object types, rather than a safe format. If user-generated content saved ...
CVE-2026-56095 Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
The extension's indexer passed every field value returned by content object rendering through PHP's unserialize function when transferring multi-value data for the SOLRCLASSIFICATION, SOLRMULTIVALUE and SOLRRELATION content object types, rather than a safe format. If user-generated content saved ...
CVE-2026-56095 Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
The extension's indexer passed every field value returned by content object rendering through PHP's unserialize function when transferring multi-value data for the SOLRCLASSIFICATION, SOLRMULTIVALUE and SOLRRELATION content object types, rather than a safe format. If user-generated content saved ...
EUVD-2026-65338
The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server...
CVE-2026-77138
CVE-2026-77138 affects the TYPO3 extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail) . The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safe processing, enabling PHP Object Injection . A remote, unauthenticated attacker can supply a ...
CVE-2026-77138 Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)
The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server...
CVE-2026-77138
The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server...
CVE-2026-77138 Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)
The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server...
WordPress Geo Controller plugin <= 8.9.8 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Geo Controller versions = 8.9.8...
WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by daroo in WordPress Plugin Booking and Rental Manager versions = 2.7.5...
WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Hash Form versions = 1.4.1...
CVE-2026-78654
A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. T...
CVE-2026-78654 cleverbrush framework/deep deepExtend.ts deepExtend prototype pollution
A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. T...
EUVD-2026-65304
A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. T...
CVE-2026-78654 cleverbrush framework/deep deepExtend.ts deepExtend prototype pollution
A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. T...
SUSE CVE-2026-77415
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects through evaluateTransformExpression, expose and deconstruct...