CVE-2026-84430

gouguoa versions up to 5.10.0/6.0.1 contain a vulnerability in the edit_personal Endpoint (file app/home/controller/Index.php, function update). Manipulation of the position_id argument leads to dynamically-determined object attributes , enabling remote exploitation. The exploit has been publicly...

EUVD-2026-69794

A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component editpersonal Endpoint. Such manipulation of the argument positionid leads to dynamically-determined object attributes...

PT-2026-84691

Name of the Vulnerable Software and Affected Versions Ninja Forms - Layout & Styles versions prior to 3.0.32 Description An unauthenticated PHP Object Injection exists in the plugin. PHP Object Injection is a vulnerability that occurs when untrusted input is passed to the PHP unserialize function...

PT-2026-84708

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog...

PT-2026-84609

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

PT-2026-84683

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

CVE-2026-81772: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles = 3.0.31 versions...

PT-2026-84572

A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component edit personal Endpoint. Such manipulation of the argument position id leads to dynamically-determined object...

CVE-2026-19116: Deserialization of Untrusted Data

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

CVE-2023-3360: Deserialization of Untrusted Data

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog...

CVE-2026-81283: Deserialization of Untrusted Data

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

CVE-2026-71981

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...

EUVD-2026-69650

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...

CVE-2026-71981

Cypht versions before 2.12.2 contain a PHP object injection vulnerability in the logout handler. The back_query GET parameter accepts a base64-encoded serialized payload that is passed directly to unserialize() without an allow-list, signature check, or type restriction, enabling gadget-chain exp...

CVE-2026-71981 Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...

CVE-2026-71981 Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...

CVE-2026-71981 Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...

CVE-2026-72649

Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...

AZL-98451 CVE-2026-72649 affecting package rubygem-elasticsearch 8.9.0-1

Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...

CVE-2026-72649

This CVE affects the Elasticsearch machine learning component , where a deserialization of untrusted data flaw (CWE-502) via object injection (CAPEC-586) permits remote code execution . A specially crafted trained model artifact can cause attacker-controlled logic to execute with a materially bro...