10427 matches found
Astra Linux – Vulnerability in libxstream-java
XStream is a Java library for serializing objects to XML and back again. In XStream before version 1.4.16, there was a vulnerability where the processed stream at unmarshalling time contained type information that allowed new instances to be created based on those type information. An attacker...
WordPress wpstorecart plugin <= 5.0.7 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability discovered by reconnaissance in WordPress Plugin WPStoreCart versions = 5.0.7...
PT-2026-91835
The backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowed classes restriction. Any code path that could write to a widget. session key with attacker-controlled bytes could trigger PHP object injection the next time the...
CVE-2026-49400: Deserialization of Untrusted Data
October System provides the system module for October Content Management System. Prior to versions 3.7.17 and 4.2.21, the backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowedclasses restriction. Any code path that could...
CVE-2026-82222-PoC
CVE-2026-82222 — GiveWP Unauthenticated PHP Object Injection → RCE Lab + proof-of-concept for CVE-2026-82222 : unauthenticated PHP object injection leading to remote code execution in the GiveWP WordPress donation plugin = 4.16.7.1 patched in 4.16.7.2...
Exploit for CVE-2026-71294
Cotonti CommentsWidget PHP Object Injection PoC Safe local pr...
PT-2026-91278
Name of the Vulnerable Software and Affected Versions October CMS versions prior to 3.7.17 October CMS versions prior to 4.2.21 Description The backend SessionMaker trait stores widget session state using base64serialize... and processes it with the unserialize function without an allowed classes...
Exploit for CVE-2026-78006
CVE-2026-78006-POC POC for CVE-2026-78006 The Events Calendar...
CVE-2026-78175
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the withdrawmethodfield parameter of the tutorsavewithdrawaccount AJAX handler. This is due to the handler lacking any capability or role...
CVE-2026-78175 Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the withdrawmethodfield parameter of the tutorsavewithdrawaccount AJAX handler. This is due to the handler lacking any capability or role...
EUVD-2026-76834
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the withdrawmethodfield parameter of the tutorsavewithdrawaccount AJAX handler. This is due to the handler lacking any capability or role...
CVE-2026-78175 Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the withdrawmethodfield parameter of the tutorsavewithdrawaccount AJAX handler. This is due to the handler lacking any capability or role...
CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the issafewidgetinstance function. This is due to insufficient protection in issafewidgetinstance, which can be bypassed because PHP fires magic methods during its...
CVE-2026-78006
The Events Calendar WordPress plugin (≤ 6.17.4 ) is vulnerable to unauthenticated PHP Object Injection leading to Remote Code Execution . The root cause is insufficient protection in is_safe_widget_instance(), which is bypassed because PHP fires magic methods during pre-parse, combined with enabl...
CVE-2026-78175
Tutor LMS (WordPress eLearning plugin) is vulnerable to PHP Object Injection in versions up to and including 4.0.7 via the withdraw_method_field parameter of the tutor_save_withdraw_account AJAX handler. The handler relies solely on a nonce without capability checks, and a flaw in how esc_sql() h...
CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the issafewidgetinstance function. This is due to insufficient protection in issafewidgetinstance, which can be bypassed because PHP fires magic methods during its...
CVE-2026-84099
The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further wh...
CVE-2026-82845
The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS...
CVE-2026-84099 IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php
The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further wh...