CVE-2026-73699

FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize in the Perms::getPerms method, where a positional array is used instead of the required named-key array to...

CVE-2026-73699

FileRun before 2026.3.0 is affected by a PHP object injection vulnerability in the Perms::getPerms() method. The root cause is an incorrect option passed to unserialize() : a positional array is used instead of the required named-key array, failing to disable class instantiation. Authenticated at...

CVE-2026-73699 FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms()

FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize in the Perms::getPerms method, where a positional array is used instead of the required named-key array to...

EUVD-2026-75601

FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize in the Perms::getPerms method, where a positional array is used instead of the required named-key array to...

CVE-2026-73699 FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms()

FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize in the Perms::getPerms method, where a positional array is used instead of the required named-key array to...

CVE-2026-81784

Unauthenticated PHP Object Injection in Wise Chat = 3.4 versions...

EUVD-2026-75517

Unauthenticated PHP Object Injection in Wise Chat = 3.4 versions...

CVE-2026-81784

An unauthenticated PHP Object Injection vulnerability affects the WordPress Wise Chat plugin in versions ≤ 3.4 , as discovered by Peng Zhou . The flaw allows a remote attacker with no prior access or user interaction to inject a crafted serialized object, leading to high impact on confidentiality...

CVE-2026-81784 WordPress Wise Chat plugin <= 3.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Wise Chat = 3.4 versions...

CVE-2026-81784 WordPress Wise Chat plugin <= 3.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Wise Chat = 3.4 versions...

CVE-2026-82925

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or...

CVE-2026-82925

The Site Reviews WordPress plugin (versions before 8.3.0 ) is vulnerable to an unauthenticated PHP object injection due to improper handling of request data deserialization. The plugin derives a protection key by padding the site's WordPress nonce key; if this key is absent, left at a sample valu...

CVE-2026-82925 Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or...

EUVD-2026-75267

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or...

CVE-2026-82925 Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or...

CVE-2026-81784: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Wise Chat = 3.4 versions...

PT-2026-89431

Unauthenticated PHP Object Injection in Wise Chat = 3.4 versions...

CVE-2026-73699: Deserialization of Untrusted Data

FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize in the Perms::getPerms method, where a positional array is used instead of the required named-key array to...

PT-2026-89297

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or...

PT-2026-89499

FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize in the Perms::getPerms method, where a positional array is used instead of the required named-key array to...