EUVD-2026-124996

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form specifically the attacker-controlled ticketlabel field inside the url-encoded form string' parameter parameter. This is due ...

CVE-2026-119077

The ELEX WordPress HelpDesk & Customer Ticketing System plugin (versions

CVE-2024-8353

This post is a research article published by EQSTLab. Thanks tocuokon, who discovered this vulnerability. Introduction Further Analysis CVE-2024-5932 EQST Insight R&TPDF file. https://github.com/user-attachments/assets/085c2f81-2894-4bb7-a3f5-62406dcb1021 CVE-2024-8353 ★ CVE-2024-8353 Arbitrary...

LKWA

LKWA Lesser Known Web Attack Lab is for intermediate pentester that can test and practice lesser known web attacks such as Object Injection, XSSI, PHAR Deserialization, variables variable ..etc. Write-ups are welcome. My own walk-through is here . Installation - Local Just clone the git with git...

CVE-2026-84753

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-84753 Write-up: https://abraxaslabs.tech/research/CVE-2026-84753 CVE-2026-84753 Mail Mint 1.31.0 - WPFunnels I am @abraxasnull. Loopback lab. The client is CVE-2026-84753-Abraxas-Labs.py. The function is name...

Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field

The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, wri...

Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection

The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize on stored entry meta...

Event Booking Manager for WooCommerce <= 5.3.6 - PHP Object Injection

Event Booking Manager for WooCommerce WordPress plugin = 5.3.6 contains an insecure deserialization vulnerability caused by deserialization of user-controlled input in event content fields, letting users with Contributor-level access inject PHP objects, potentially leading to arbitrary file...

My Geo Posts Free <= 1.2 - PHP Object Injection

The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If ...

LearnPress <= 4.4.9.1 - PHP Object Injection

LearnPress WordPress plugin = 4.4.10 contains a PHP Object Injection caused by deserialization of untrusted 'checkout-email' parameter in checkout AJAX action, letting unauthenticated attackers inject PHP objects remotely. id: CVE-2026-104736 info: name: LearnPress = 4.4.9.1 - PHP Object Injectio...

SEOPress < 7.9 - Authentication Bypass

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present. id:...

GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1. This is due to insufficient input validation on user-supplied data. An unauthenticated attacker can inject a serialized PHP object, which...

GiveWP - PHP Object Injection

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'givetitle' parameter. id: CVE-2024-5932 info: name: GiveWP - PHP Object Injection author:...

Revive Adserver 4.2 - Remote Code Execution

Revive Adserver 4.2 is susceptible to remote code execution. An attacker can send a crafted payload to the XML-RPC invocation script and trigger the unserialize call on the "what" parameter in the "openads.spc" RPC method. This can be exploited to perform various types of attacks, e.g...

SugarCRM - Unauthenticated Remote Code Execution via PHP Object Injection

A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the restdata parameter before passing it to the...

GiveWP <= 4.16.7.1 - Remote Code Execution

GiveWP = 4.16.7.1 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires crafted input id: CVE-2026-82222 info: name: GiveWP = 4.16.7.1 - Remote Code Execution author: 0xAkoko,pdteam...

Better Search Replace < 1.4.5 - PHP Object Injection

The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. I...

CVE-2026-19658

CVE-2026-19658 — Give Tributes Unauthenticated PHP Object Injection Python 3 proof-of-concept scanner and donation-chain exploit helper for CVE-2026-19658 in the WordPress add-on Give - Tributes Liquid Web / GiveWP. | ---|--- Platform| WordPress plugin requires GiveWP core Component| Give -...

HTTP-Request-for-PHP-object-injection-attack-on-CVE-2023-41892

This type of attack attempts to exploit the PHP application's deserialization process to execute arbitrary code or carry out unintended actions on the server. Mitigation Strategies To defend against PHP object injection and similar attacks, consider the following strategies: Disable PHP Object...

Mintinstall-object-injection

TR Linux mint yazılım yöneticisi v 7.9.5/9 yanlış yapılandırmadan dolayı obje enjeksiyonu ve keyfi kod çalıştırmamıza neden olmaktadır. EN Linux mint software manager v 7.9.5/9 causes us to execute object injection and arbitrary code due to incorrect configuration mintinsall TR Mint yazılım...