wordpress-php-object-helper

wordpress-php-object-helper About You have a Known plugin with a PHP object exploit?, but you need to determine which library to use to exploit the issue and run with phpggc. This should help you out. Example Output $ python3 finder.py -u http://wordpress.lan -f wp-plugins.lst Processing URLs:...

CVE-2024-1651-PoC

CVE-2024-1651 This CVE was discovered by Carlos Bello from the Fluid Attack Offensive Team. The finding discusses Insecure Object Deserialization to obtain RCE Remote Code Execution. Here, I have created a faster and easier-to-use PoC Proof of Concept. Therefore, if anyone wants to reproduce the...

CVE-2025-49113

📧 Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization CVE-2025-49113 🔍 Writeup A critical post-authentication Remote Code Execution vulnerability was discovered in Roundcube versions ≤ 1.6.10, caused by insecure PHP object deserialization. This severe flaw has silently persisted in th...

CVE-2025-49113-Simulation

Roundcube RCE Lab CVE-2025-49113 A hands-on, containerized lab environment to simulate and exploit a critical Post-Authentication RCE vulnerability in Roundcube Webmail, identified as CVE-2025-49113. 📖 About The Vulnerability This lab demonstrates a sophisticated attack chain against the Roundcub...

CVE-2018-19276

CVE-2018-19276 OpenMRS Insecure Object Deserialization RCE From https://talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607 Insecure object deserialization allows Arbitrary Code Execution without needing to log in. IP restrictions on Webservices module do not prevent thi...

CVE-2024-1651-PoC

CVE-2024-1651 This CVE was discovered by Carlos Bello from the Fluid Attack Offensive Team. The finding discusses Insecure Object Deserialization to obtain RCE Remote Code Execution. Here, I have created a faster and easier-to-use PoC Proof of Concept. Therefore, if anyone wants to reproduce the...

CVE-2025-49113

Python Script for CVE-2025-49113 Usage: python exploit.py https://ubuntu.com/security/CVE-2025-49113 Description: Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the from parameter in a URL is not validated in...

givewp-cve-2026-82222-rce-lab

CVE-2026-82222 — GiveWP Marker-Only RCE Validation Lab Security-research material for reproducing and validating CVE-2026-82222 in an isolated Docker lab. For Direct RCE Poc and url scan useCVE-2026-8222-RCE.py Verdict Status: proven in the supplied lab GiveWP 4.16.5.1 permits an initially...

session_reaper_lab

CVE-2025-54236 - SessionReaper Lab Docker environment for practical demonstration of CVE-2025-54236 SessionReaper: PHP Object Deserialization leading to RCE in Magento Open Source 2.4.7. Exclusive use in controlled environment. Do not run against systems without explicit authorization. About the...

exploit-CVE-2025-49113

CVE-2025-49113 PoC Repository Overview of CVE-2025-49113 CVE-2025-49113 is a critical vulnerability affecting Roundcube Webmail versions prior to 1.5.10 and 1.6.11. Discovered in 2025, this flaw allows remote code execution RCE through PHP Object Deserialization in the /settings/upload.php...

OpenMRS Platform < 2.24.0 - Insecure Object Deserialization

OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body. id: CVE-2018-19276 info: name: OpenMRS Platform 2.24.0 - Insecure Object...

WordPress Weaver Show Posts plugin < 1.8.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Do Xuan Trung in WordPress Plugin Weaver Show Posts versions 1.8.1...

CVE-2026-84752

Contributor PHP Object Injection in RTMKit = 2.1.5 versions...

CVE-2026-84753 WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Mail Mint = 1.31.0 versions...

PT-2026-85119

Unauthenticated PHP Object Injection in JobSearch = 3.2.0 versions...

WordPress User Profile Builder plugin < 4.0.1 - Admin+ PHP Object Injection vulnerability

Admin+ PHP Object Injection vulnerability discovered by Vivien LEBAS in WordPress Plugin Profile Builder versions 4.0.1...

mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

Impact Prior to version 0.6.0, mchange-commons-java includes a JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory willing to construct objects of arbitrary classes and initialize "JavaBean"-style properties. There are classes for which this kind of initialization is...

CVE-2025-15672 Chama < 1.0.13 - Unauthenticated PHP Object Injection

The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects, which could lead to remote code execution when a suitable gadget chain is present via other...

CVE-2026-12720

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present ...

CVE-2026-15962 Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...