CVE-2026-9691

CVE-2026-9691 CVE-2026-9691: Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms = 1.1.1 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule...

CVE-2024-52433

CVE-2024-52433 My Geo Posts Free = 1.2 - Unauthenticated PHP Object Injection Description The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated...

CVE-2024-12877-Exploit

GO-TO CVE – CVE-2024-12877-Exploit Week 66 | Author: Ali Soltani soltanali0 Welcome to Week 66 of the GO-TO CVE series , where we dissect vulnerabilities, analyze root causes, and demonstrate practical exploitation techniques in a safe, educational context. 🚨 Overview CVE-2024-12877 is a PHP Obje...

CVE-2025-1974

Exploit for Ingress NGINX - IngressNightmare This project provides an exploit targeting critical unauthenticated Remote Code Execution RCE vulnerabilities in the Ingress NGINX Controller for Kubernetes, collectively referred to as IngressNightmare. In the original research, the Wiz team did not...

Mintinstall-object-injection

Gestionnaire de logiciels Linux Mint v 7.9.5/9 – en raison d'une configuration incorrecte, cela provoque une injection d'objet et l'exécution de code arbitraire. mintinstall Lorsque vous lancez le gestionnaire de logiciels Mint, il vérifie la présence de nouveaux commentaires ; s'il y en a, il le...

js2py-Sandbox-Escape-CVE-2024-28397-RCE

CVE-2024-28397 js2py Sandbox Escape Exploit A collection of exploit scripts targeting the js2py sandbox escape vulnerability CVE-2024-28397 that allows arbitrary code execution through Python object introspection. 🔍 Vulnerability Overview The js2py library contains a critical sandbox escape...

CVE-2025-49113

Python Script for CVE-2025-49113 Usage: python exploit.py https://ubuntu.com/security/CVE-2025-49113 Description: Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the from parameter in a URL is not validated in...

WordPress VK Google Job Posting Manager plugin <= 1.3.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin VK Google Job Posting Manager versions = 1.3.1...

WordPress WP Spell Check plugin <= 12.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Spell Check versions = 12.1...

WordPress Simple Event Planner plugin <= 1.5.7 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Simple Event Planner versions = 1.5.7...

WordPress Sunshine Photo Cart plugin <= 3.7.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Sunshine Photo Cart versions = 3.7.1...

WordPress WP Ultimate Exporter plugin <= 3.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Ultimate Exporter versions = 3.0...

WordPress Product Feed PRO for WooCommerce plugin <= 13.5.7 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Product Feed PRO for WooCommerce versions = 13.5.7...

WordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Pay with Vipps for WooCommerce versions = 6.2.0...

WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Peter Tang in WordPress Plugin Advanced Post Manager versions = 4.5.5...

CVE-2026-103441

CVE-2026-103441: Инъекция сериализованного объекта сущности Wikibase Автор отчёта: Marco Paciaroni BomboBombone. Публичный API action=parse принимал PHP-сериализованные сущности Wikibase. Неограниченное конструирование объектов могло достичь деструктора Smarty, который удаляет путь, выбранный...

CVE-2026-103442

CVE-2026-103442: Инъекция объекта в CentralAuth MergeAccount Автор отчёта: Marco Paciaroni BomboBombone. CentralAuth принимал предоставленный браузером ключ сессии слияния при декодировании состояния миграции. Пользователь с правом centralauth-merge мог подставить ключ, который порождал граф...

HTTP-Request-for-PHP-object-injection-attack-on-CVE-2023-41892

This type of attack attempts to exploit the PHP application's deserialization process to execute arbitrary code or carry out unintended actions on the server. Mitigation Strategies To defend against PHP object injection and similar attacks, consider the following strategies: Disable PHP Object...

CVE-2024-23339

CVE-2024-23339 취약점 개요 CVE-2024-23339 CVSS : 6.5 Jan 23, 2024 ProtoType Pollution in node.js package rebob 프로젝트의 일환 취약점 설명 github advisories hoolock is a suite of lightweight utilities designed to maintain a small footprint when bundled. Starting in version 2.0.0 and prior to version 2.2.1, utilit...

CVE-2025-32463-Sudo-Chroot-Escape

CVE-2025-32463-Sudo-Chroot-Escape Description This repository contains a Python-based Proof of Concept PoC for CVE-2025-32463, a local privilege escalation vulnerability in the sudo versions 1.9.14 through 1.9.17. When a user has sudo privileges to run a command within a chroot environment -R fla...