Lucene search
+L

4036 matches found

NVD
NVD
added 2026/09/10 3:17 p.m.3 views

CVE-2026-81784

Unauthenticated PHP Object Injection in Wise Chat = 3.4 versions...

8.1CVSS
SaveExploits0References1
CVE
CVE
added 2026/09/10 2:23 p.m.6 views

CVE-2026-81784

An unauthenticated PHP Object Injection vulnerability affects the WordPress Wise Chat plugin in versions ≤ 3.4 , as discovered by Peng Zhou . The flaw allows a remote attacker with no prior access or user interaction to inject a crafted serialized object, leading to high impact on confidentiality...

8.1CVSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/10 2:23 p.m.3 views

EUVD-2026-75517

Unauthenticated PHP Object Injection in Wise Chat = 3.4 versions...

8.1CVSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/10 7:56 a.m.5 views

CVE-2023-1405

CVE-2023-1405 Formidable Forms = 6.1.2 - Unauthenticated PHP Object Injection Description: The Formidable Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.1.2 via deserialization of untrusted input from form submissions. This allows...

7.5CVSS7.7AI score0.00702EPSS
SaveExploits2
NVD
NVD
added 2026/09/10 7:17 a.m.2 views

CVE-2026-82925

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or...

8.1CVSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/10 6:31 a.m.9 views

CVE-2025-32432

CraftCMS CVE-2025-32432 Exploit By Chirag Artani Overview This repository contains a proof-of-concept exploit script for CVE-2025-32432, a pre-authentication Remote Code Execution RCE vulnerability affecting CraftCMS versions 4.x and 5.x. The vulnerability exists in the asset transform generation...

10CVSS8.3AI score0.99837EPSS
SaveExploits19
CVE
CVE
added 2026/09/10 6:00 a.m.7 views

CVE-2026-82925

Site Reviews WordPress plugin versions 7.2.2 through 8.2.2 (before 8.3.0) allow unauthenticated PHP object injection via a deserialization flaw in its form-signature handling. The plugin derives its protection key by padding the site's WordPress nonce key , making it publicly computable when that...

8.1CVSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/10 6:00 a.m.6 views

CVE-2026-82925 Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or...

SaveExploits0References1
Kitploit
Kitploit
added 2026/09/10 5:37 a.m.5 views

CVE-2026-46275

CVE-2026-46725 — TYPO3 ceselector Extension RCE PHP Object Injection viaunserialize Cookie Bypass → Remote Code Execution 📋 Table of Contents About the Vulnerability Technical Details Requirements Installation Usage Examples Output Format How It Works References...

9.2CVSS5.7AI score0.02625EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/10 5:00 a.m.6 views

CVE-2026-48909

CVE-2026-48909 — SP LMS PHP Object Injection → RCE Unauthenticated Remote Code Execution via PHP Object Injection in JoomShaper SP LMS comsplms ≤ 4.1.3 for Joomla CMS. Author: Amin İsayev / Proxima Cyber Security Overview SP LMS is a popular Joomla Learning Management System extension by JoomShap...

9.5CVSS6AI score0.04941EPSS
SaveExploits5
Nuclei
Nuclei
added 2026/09/10 4:50 a.m.29 views

Better Search Replace < 1.4.5 - PHP Object Injection

The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. I...

9.8CVSS8.1AI score0.68047EPSS
SaveExploits2References2
Kitploit
Kitploit
added 2026/09/10 12:55 a.m.8 views

CVE-2026-54806

WP Activity Log PHP Object Injection CVE-2026-54806 PoC 📜 Description CVE-2026-54806 is a critical CVSS 9.8 unauthenticated PHP Object Injection vulnerability in the WP Activity Log WordPress plugin wp-security-audit-log by Melapress. An unauthenticated attacker can inject serialized PHP objects...

9.8CVSS5.9AI score0.00699EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/10 12:39 a.m.12 views

CVE-2023-27372-SPIP-4.2.1-Unauthenticated-RCE-PoC

CVE-2023-27372 — SPIP Unauthenticated remote code execution vulnerability in SPIP before 4.2.1. The oubli parameter in the password reset form is vulnerable to PHP object injection due to mishandled deserialization. A crafted serialized payload is executed server-side as the web user, and the...

9.8CVSS8.1AI score0.99682EPSS
SaveExploits23
Kitploit
Kitploit
added 2026/09/09 8:06 p.m.7 views

CVE-2025-22510

CVE-2025-22510 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name WC Price History for Omnibus Vulnerable version To activate this plugin, the WooCommerce plugin must first be installed and activated. 2. To test the PHP Object Inj...

7.2CVSS8.1AI score0.01225EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/09 7:53 p.m.6 views

CVE-2025-7384

CVE-2025-7384 — PHP Object Injection to RCE Plugin: Database for Contact Form 7 contact-form-entries ≤ 1.4.3 CVSS: 9.8 Critical CWE: CWE-502 — Deserialization of Untrusted Data Authentication Requirement: None Unauthenticated Impact: Remote Code Execution Table of Contents 1. Vulnerability Overvi...

9.8CVSS6.2AI score0.01281EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/09 7:20 p.m.5 views

CVE-2023-6933

Introduction to CVE-2023-6933 Vulnerability Description The "Better Search Replace" plugin for WordPress exhibits a critical vulnerability known as PHP Object Injection. This security flaw is present in all versions up to and including 1.4.4. It arises from the deserialization of untrusted input,...

9.8CVSS8.1AI score0.68047EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/09 6:10 p.m.6 views

CVE-2026-49105

CVE-2026-49105 CVE-2026-49105 WP Zendesk PHP Object Injection Exploit...

9.8CVSS5.8AI score0.00476EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/09 6:01 p.m.6 views

CVE-2026-49104-

CVE-2026-49104- CVE-2026-49104 Integration for Keap/Infusionsoft PHP Object Injection Exploit...

9.8CVSS5.8AI score0.00476EPSS
SaveExploits1
CVE
CVE
added 2026/09/09 4:45 p.m.11 views

CVE-2026-87930

MaxSite CMS through version 109.6 is affected by a PHP Object Injection vulnerability in the ci_session cookie handling. The Session library passes the cookie value to unserialize() without class restrictions, and a hardcoded encryption key allows unauthenticated attackers to forge valid session ...

9.2CVSS
SaveExploits0References7
Cvelist
Cvelist
added 2026/09/09 4:45 p.m.24 views

CVE-2026-87930 MaxSite CMS through 109.6 PHP Object Injection via ci_session

MaxSite CMS through 109.6 passes the cisession cookie to unserialize without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve...

9.2CVSS
SaveExploits0References7
Rows per page
Query Builder