CVE-2026-97296: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1...

CVE-2026-104730: Deserialization of Untrusted Data

The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2026-111628: Deserialization of Untrusted Data

10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which setmeta in includes/utils.php unserializes on the...

CVE-2026-104932: Deserialization of Untrusted Data

The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replaceall function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain...

PT-2026-115448

Name of the Vulnerable Software and Affected Versions Search Regex version 3.5 Description An issue exists where authenticated users with subscriber-level access and above can perform PHP Object Injection. This occurs through the deserialization of untrusted input within the replace all function...

PT-2026-116027

10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set meta in includes/utils.php unserializes on the...

VulnCheck KEV: CVE-2026-104736

The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitizetextfield, which does not stri...

PT-2026-115484

Name of the Vulnerable Software and Affected Versions Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers versions prior to 3.7.5 Description An issue exists where unauthenticated attackers can perform PHP Object Injection through the deserialization of untrusted input...

CVE-2026-110874

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize in functions.lib.php, which calls unserialize without class restrictions when jsondecode fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized...

CVE-2026-110874

Dolibarr versions prior to 23.0.4 are vulnerable to a PHP object injection flaw within the jsonOrUnserialize() function in functions.lib.php. The vulnerability occurs because the application calls unserialize() without class restrictions when json_decode() fails. If an attacker can provide input ...

EUVD-2026-102349

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize in functions.lib.php, which calls unserialize without class restrictions when jsondecode fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized...

CVE-2026-110874 Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize in functions.lib.php, which calls unserialize without class restrictions when jsondecode fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized...

CVE-2026-110874 Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize in functions.lib.php, which calls unserialize without class restrictions when jsondecode fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized...

Astra Linux – Vulnerability in libxstream-java

XStream is a Java library for serializing objects to XML and back again. In XStream before version 1.4.16, there was a vulnerability where the processed stream contained type information at the time of unmarshaling, allowing new instances to be created based on those type information. Attackers...

CVE-2026-109686

Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7...

CVE-2026-109686

The Link Whisper Free plugin (versions through 0.9.7 ) for WordPress is vulnerable to a Deserialization of Untrusted Data vulnerability. This flaw allows for Object Injection , potentially leading to significant impacts on confidentiality, integrity, and availability. The vulnerability is identif...

CVE-2026-109686 WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7...

EUVD-2026-102053

Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7...

CVE-2026-109686: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7...

CVE-2026-110874: Deserialization of Untrusted Data

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize in functions.lib.php, which calls unserialize without class restrictions when jsondecode fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized...