5000 matches found
CVE-2026-48909
CVE-2026-48909 — SP LMS PHP Object Injection → RCE Unauthenticated Remote Code Execution via PHP Object Injection in JoomShaper SP LMS comsplms ≤ 4.1.3 for Joomla CMS. Author: Amin İsayev / Proxima Cyber Security Overview SP LMS is a popular Joomla Learning Management System extension by JoomShap...
CVE-2018-20718
CVE-2018-20718 This is a POC for CVE-2018-20718. It is a PHP Object injection vulnerability. The vulnerability affect all version of Pydio before 8.2.1 and leads to Unauthenticated Remote Code Execution. It was originaly found by RIPS. I found a gadget in Pydio\Core\Controller\ShutdownScheduler...
CVE-2025-7384
CVE-2025-7384 — PHP Object Injection to RCE Plugin: Database for Contact Form 7 contact-form-entries ≤ 1.4.3 CVSS: 9.8 Critical CWE: CWE-502 — Deserialization of Untrusted Data Authentication Requirement: None Unauthenticated Impact: Remote Code Execution Table of Contents 1. Vulnerability Overvi...
CVE-2024-8353
This post is a research article published by EQSTLab. Thanks tocuokon, who discovered this vulnerability. Introduction Further Analysis CVE-2024-5932 EQST Insight R&TPDF file. https://github.com/user-attachments/assets/085c2f81-2894-4bb7-a3f5-62406dcb1021 CVE-2024-8353 ★ CVE-2024-8353 Arbitrary...
CVE-2026-54806
WP Activity Log PHP Object Injection CVE-2026-54806 PoC 📜 Description CVE-2026-54806 is a critical CVSS 9.8 unauthenticated PHP Object Injection vulnerability in the WP Activity Log WordPress plugin wp-security-audit-log by Melapress. An unauthenticated attacker can inject serialized PHP objects...
CVE-2019-6340
CVE-2019-6340 For educational purposes only Run $ docker run --rm -p 8080:80 knqyf263/cve-2019-6340 Exploit GET $ curl -XGET -H "Content-Type: application/hal+json" "http://localhost:8080/node/1?format=haljson" -d ' "link": "value": "link", "options":...
CVE-2026-82226
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-82226 CVE-2026-82226 Tickera 3.6.0.2 - Tickera I am @abraxasnull. Loopback lab. The client is CVE-2026-82226-Abraxas-Labs.py. Checkout unserializes the attendee. Unauthenticated cart - process-payment...
CVE-2024-12877
CVE-2024-12877 GiveWP – Donation Plugin and Fundraising Platform = 3.19.2 - Unauthenticated PHP Object Injection Description The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via...
CVE-2026-84753
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-84753 CVE-2026-84753 Mail Mint 1.31.0 - WPFunnels I am @abraxasnull. Loopback lab. The client is CVE-2026-84753-Abraxas-Labs.py. The function is named safe. Unauthenticated REST mint-form-submit copies extra...
CVE-2023-27372-SPIP-4.2.1-Unauthenticated-RCE-PoC
CVE-2023-27372 — SPIP Unauthenticated remote code execution vulnerability in SPIP before 4.2.1. The oubli parameter in the password reset form is vulnerable to PHP object injection due to mishandled deserialization. A crafted serialized payload is executed server-side as the web user, and the...
My Geo Posts Free <= 1.2 - PHP Object Injection
The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If ...
GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1. This is due to insufficient input validation on user-supplied data. An unauthenticated attacker can inject a serialized PHP object, which...
Better Search Replace < 1.4.5 - PHP Object Injection
The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. I...
CVE-2025-32432
CraftCMS CVE-2025-32432 Exploit By Chirag Artani Overview This repository contains a proof-of-concept exploit script for CVE-2025-32432, a pre-authentication Remote Code Execution RCE vulnerability affecting CraftCMS versions 4.x and 5.x. The vulnerability exists in the asset transform generation...
cve-2026-39440-funnelforms-fix
CVE-2026-39440 FunnelForms Fix A drop-in WordPress plugin that blocks the vulnerable Demo Import handler in FunnelForms Pro ≤ 3.8.1 to mitigate Remote Code Execution CVE-2026-39440, CVSS 9.9. The Vulnerability Field| Value ---|--- CVE ID| CVE-2026-39440 CVSS Score| 9.9 Critical Affected|...
CVE-2026-97284
Contributor PHP Object Injection in Icegram = 3.1.31 versions...
CVE-2026-94390
Editor PHP Object Injection in Hide Shipping Method For WooCommerce = 1.5.4 versions...
CVE-2023-46615
CVE-2023-46615 KD Coming Soon = 1.7 - Unauthenticated PHP Object Injection via cetitle Description: The KD Coming Soon plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7 via deserialization of untrusted input cetitle in the vulnerable kdcemailer...
CVE-2024-56059
CVE-2024-56059 Partners = 0.2.0 - Unauthenticated PHP Object Injection Description The Partners plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 0.2.0 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject...
