45072 matches found
CVE-2025-69127: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Plumbing = 1.6 versions...
CVE-2026-40760: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Behold = 1.5 versions...
PT-2026-50254
The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level...
CVE-2025-69111: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Reisen = 1.4.1 versions...
CVE-2026-40752: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Manufaktur Solutions = 1.1.1 versions...
PT-2026-50305
Unauthenticated PHP Object Injection in Mildhill = 1.5 versions...
PT-2026-50323
Unauthenticated Insecure Direct Object References IDOR in Salon booking system = 10.30.24 versions...
CVE-2026-40754: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Roisin = 1.4 versions...
CVE-2026-27429: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Nifty = 1.4.1 versions...
PT-2026-50406
Unauthenticated PHP Object Injection in Manufaktur Solutions = 1.1.1 versions...
PT-2026-50531
Name of the Vulnerable Software and Affected Versions Pimcore CMS/DXP version 12.3.8 Description A sandbox bypass allows authenticated administrative attackers to execute arbitrary methods on PHP objects. This occurs due to empty checkMethodAllowed and checkPropertyAllowed implementations within...
PT-2026-50385
Deserialization of Untrusted Data vulnerability in Themeton Lagom allows Object Injection. This issue affects Lagom: from n/a through 2.0...
PT-2026-50274
Name of the Vulnerable Software and Affected Versions ThemeREX Addons versions prior to 2.36.1.2 Description Unauthenticated PHP Object Injection occurs in the software. PHP Object Injection is a vulnerability that allows an attacker to inject malicious objects into a PHP application, which can...
CVE-2026-39567: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Santé = 1.5.1 versions...
CVE-2026-39445: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Alukas 3.0.0 versions...
CVE-2026-39443: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in EmallShop = 2.4.21 versions...
CVE-2026-39446: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Kapee 1.7.0 versions...
CVE-2026-39442: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in PressMart = 1.2.26 versions...