11104 matches found
EUVD-2026-50275
Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution...
CVE-2026-65883
Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution...
CVE-2026-65883 Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0
Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution...
CVE-2026-65883 Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0
Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution...
PT-2026-65780
Name of the Vulnerable Software and Affected Versions Aimy Captcha-Less Form Guard versions 18.0 through 20.0 Description PHP object injection occurs when a forged clfgd field is processed, which can lead to remote code execution. PHP object injection is a vulnerability where untrusted input is...
CVE-2026-65883: Deserialization of Untrusted Data
Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution...
WordPress Export User Data plugin <= 2.2.6 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Export User Data versions = 2.2.6...
WordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by daroo in WordPress Plugin Jeg Kit for Elementor versions = 3.2.10...
PT-2026-68550
Name of the Vulnerable Software and Affected Versions Jeg Kit for Elementor versions prior to 3.2.11 Description The Jeg Kit for Elementor plugin for WordPress is susceptible to PHP Object Injection, a condition where an application deserializes untrusted input, potentially allowing an attacker t...
PT-2026-68551
Name of the Vulnerable Software and Affected Versions Export User Data versions prior to 2.2.7 Description The Export User Data plugin for WordPress allows authenticated attackers with subscriber-level access and above to perform PHP Object Injection. This occurs through the deserialization of...
CVE-2026-15962
The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...
EUVD-2026-49047
The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...
CVE-2026-15962
CVE-2026-15962 affects the Fluent Forms Pro Add On Pack for WordPress (all versions up to 6.2.6). It enables PHP Object Injection through deserialization of untrusted input. An authenticated attacker with Subscriber-level access or higher can inject a PHP Object, with a POP chain allowing passwor...
CVE-2026-15962 Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field
The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...
CVE-2026-15962
The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...
PT-2026-64792
The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...
CVE-2026-15962: Deserialization of Untrusted Data
The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...
CVE-2026-65497
Administrator PHP Object Injection in Complianz = 7.5.0 versions...