11586 matches found
CVE-2024-1813-POC
CVE-2024-1813 - Simple Job Board ≤ 2.11.0 WordPress - Unauthenticated PHP Object Injection 🎥 Proof-of-Concept demo End-to-end: a guest stores a serialized PHP object through the public application form, the admin opens the applicants list, and the gadget chain drops a webshell. Unauthenticated PH...
CVE-2026-9691
CVE-2026-9691 CVE-2026-9691: Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms = 1.1.1 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule...
PT-2026-120956
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube session::unserialize. A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing t...
Linux Distros Unpatched Vulnerability : CVE-2026-114724
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcubesession::unserialize. A session key prefixed with ! was...
CVE-2026-65883
CVE-2026-65883 — Aimy Captcha-Less Form Guard = 20.0 clfgd Field → XOR Recovery → unserialize → FormattedtextLogger → RCE Overview Unauthenticated PHP Object Injection in Aimy Captcha-Less Form Guard for Joomla. The onCheckAnswer method base64-decodes the attacker-controlled clfgd POST field, run...
CVE-2026-7654
CVE-2026-7654 CVE-2026-7654 Admin Columns PHP Object Injection RCE Exploit...
CVE-2026-49085
CVE-2026-49085 CVE-2026-49085 WP Insightly PHP Object Injection Exploit...
CVE-2026-29001
TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute when the setting ...
CVE-2026-29001 TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization
TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute when the setting ...
CVE-2026-29001
TastyIgniter versions up to and including 4.4.5 are vulnerable to a PHP object injection vulnerability. The root cause is the unsanitized storage and subsequent unserialization of settings values via the getValueAttribute() function. Authenticated administrators can exploit this by submitting a s...
EUVD-2026-107571
TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute when the setting ...
CVE-2026-29001 TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization
TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute when the setting ...
CVE-2024-12877
CVE-2024-12877 GiveWP – Donation Plugin and Fundraising Platform = 3.19.2 - Unauthenticated PHP Object Injection Description The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via...
WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Hostme v2 versions = 7.0...
WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Holistic Center versions = 1.2.6...
WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by johska in WordPress Theme ZenSoul versions = 1.13...
Exploit for CVE-2026-109618
CVE-2026-109618 / CVE-2026-109619 — PHP session.uploadprogres...
WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by johska in WordPress Theme Save Life versions = 1.2.14...