12411 matches found
CVE-2026-27429: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Nifty = 1.4.1 versions...
CVE-2026-12115: Deserialization of Untrusted Data
The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level...
CVE-2025-69108: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Hot Coffee = 1.7 versions...
CVE-2026-39576: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in SingleMalt = 1.5 versions...
PT-2026-50274
Name of the Vulnerable Software and Affected Versions ThemeREX Addons versions prior to 2.36.1.2 Description Unauthenticated PHP Object Injection occurs in the software. PHP Object Injection is a vulnerability that allows an attacker to inject malicious objects into a PHP application, which can...
CVE-2026-40738: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Eldon = 1.4.1 versions...
Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048
The Formatter Field module provides a mechanism for specifying a formatter and formatter settings to be used for displaying a field, on a per-entity basis. formatterfield stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can...
Drupal core - Critical - PHP object injection - SA-CORE-2026-005
SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web services. The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially inject a malicious payload in certain...
CVE-2026-39554: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Fidalgo = 1.2.2 versions...
CVE-2026-40733: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in ShiftUp = 1.3 versions...
CVE-2026-39442: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in PressMart = 1.2.26 versions...
CVE-2025-60236: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in EMV Creatify allows Object Injection. This issue affects Creatify: from n/a through 1.5...
CVE-2026-49075: Deserialization of Untrusted Data
Contributor PHP Object Injection in JetEngine = 3.8.9.1 versions...
CVE-2026-40760: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Behold = 1.5 versions...
CVE-2026-40759: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Esmée = 1.4 versions...
CVE-2026-40758: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Léonie = 1.2.1 versions...
CVE-2026-40754: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Roisin = 1.4 versions...
CVE-2026-40735: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Reina = 2.1 versions...