CVE-2026-25615

Blesta 3.x–5.x prior to 5.13.3 is affected by CVE-2026-25615 (CORE-5668), a PHP object-injection vulnerability. Public details describe vulnerability through admin interfaces (admin_clients.php and admin_company_groups.php) where unserialize() is applied to unsanitized input, enabling injection o...

CVE-2026-25615

Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668...

CVE-2026-25615

Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668...

CVE-2026-25614

Blesta 3.x–5.x prior to 5.13.3 is affected by an object injection vulnerability (CORE-5680). User input passed via invoices (POST) or item-ext-ref (GET) can reach unserialize() in Checkout2::validate()/Checkout2::success(), allowing arbitrary PHP objects to be injected. This enables potential rem...

EUVD-2026-5170

Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680...

CVE-2026-25614

Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680...

CVE-2026-25614

Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680...

CVE-2026-25614

Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680...

CVE-2026-24954

Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through = 5.0.8...

CVE-2026-24954

Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through = 5.0.8...

EUVD-2026-5193

Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through = 5.0.8...

CVE-2026-24954 WordPress WpEvently plugin <= 5.0.8 - Deserialization of untrusted data vulnerability

Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through = 5.0.8...

CVE-2026-24954 WordPress WpEvently plugin <= 5.0.8 - Deserialization of untrusted data vulnerability

Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through = 5.0.8...

CVE-2026-24954

CVE-2026-24954 concerns the WordPress plugin WpEvently mage-eventpress. The vulnerability is due to deserialization of untrusted data, enabling object injection in the affected software. Affected versions are n/a through 5.0.8 for WpEvently mage-eventpress. Public records consistently describe th...

WordPress SevenHills theme <= 1.6.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme SevenHills versions = 1.6.2...

VulnCheck KEV: CVE-2024-12877

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via deserialization of untrusted input from the donation form like 'firstName'. This makes it possible for unauthenticated attackers to...

Blesta code-related vulnerabilities

Blesta is a customer relationship management system developed by Blesta Inc. Versions of Blesta prior to 5.13.3 contained a code vulnerability caused by object injection...

CVE-2026-25614: Deserialization of Untrusted Data

Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680...

CVE-2026-25615: Deserialization of Untrusted Data

Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668...

PT-2026-6331

Name of the Vulnerable Software and Affected Versions Blesta versions 3.x through 5.x before 5.13.3 Description The software contains a flaw that allows for object injection. This issue is also known as CORE-5680. Recommendations Update to version 5.13.3 or later...