CVE-2025-32432

CVE-2025-32432 Craft CMS — PoC RCE pré-auth Exécution de code à distance critique avant authentification dans Craft CMS Versions concernées : Craft CMS 3.x, 4.x et 5.x jusqu'à 5.6.16 Info : Cet exploit a été testé contre la machine Orion de HackTheBox Aperçu Ce dépôt contient un exploit...

CVE-2022-24990

CVE-2022-24990 Description - POC pour CVE-2022-24990 : Exécution de commandes à distance non authentifiée sur TerraMaster TOS via l'instanciation d'objets PHP. - créé par antx le 2022-04-12. Détail - La vulnérabilité permet à un attaquant distant d'exécuter des commandes arbitraires sur le...

CVE-2022-24990

CVE-2022-24990 CVE-2022-24990 تنفيذ أوامر عن بعد غير موثوق في TerraMaster TOS عبر استنساخ كائن PHP الاستخدام الكشف عن الثغرات. python CVE-2022-24990.py -u http://127.0.0.1:8080 رفع شيل ويب PHP. python CVE-2022-24990.py -a http://127.0.0.1:8080 المراجع...

CVE-2026-10721: Deserialization of Untrusted Data

Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize calls in the in Permission, Cache, and Search components. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database. Thanks XananasX7...

CVE-2017-18375

Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php...

EUVD-2025-204565

pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. Prior to version 1.1.2, in certain conditions database write access must first be obtained through another vulnerability or misconfiguration...

CVE-2025-65035: Deserialization of Untrusted Data

pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. Prior to version 1.1.2, in certain conditions database write access must first be obtained through another vulnerability or misconfiguration...

EUVD-2017-9491

Malware in sbrugna...

EUVD-2025-9694

Malicious code in bioql PyPI...

CVE-2025-7825: Improper Neutralization of Directives in Statically Saved Code

The Schema Plugin For Divi, Gutenberg & Shortcodes plugin for WordPress is vulnerable to Object Instantiation in all versions up to, and including, 4.3.2 via deserialization of untrusted input via the wptschemabreadcrumbs shortcode. This makes it possible for authenticated attackers, with...

CVE-2019-12799

In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code...

CVE-2024-13645

The tagDiv Composer plugin for WordPress is vulnerable to PHP Object Instantiation in all versions up to, and including, 5.3 via module parameter. This makes it possible for unauthenticated attackers to Instantiate a PHP Object. No known POP chain is present in the vulnerable software, which mean...

CVE-2024-13645

The tagDiv Composer plugin for WordPress is vulnerable to PHP Object Instantiation in all versions up to, and including, 5.3 via module parameter. This makes it possible for unauthenticated attackers to Instantiate a PHP Object. No known POP chain is present in the vulnerable software, which mean...

CVE-2024-13645

CVE-2024-13645 affects the WordPress tagging plugin TagDiv Composer (all versions up to and including 5.3). It describes PHP Object Instantiation via a module parameter, enabling unauthenticated object instantiation. The impact is conditional on a POP chain being present in the target environment...

CVE-2024-13645 TagDiv Composer <= 5.3 - Unauthenticated Arbitrary PHP Object Instantiation

The tagDiv Composer plugin for WordPress is vulnerable to PHP Object Instantiation in all versions up to, and including, 5.3 via module parameter. This makes it possible for unauthenticated attackers to Instantiate a PHP Object. No known POP chain is present in the vulnerable software, which mean...

CVE-2024-13645 TagDiv Composer <= 5.3 - Unauthenticated Arbitrary PHP Object Instantiation

The tagDiv Composer plugin for WordPress is vulnerable to PHP Object Instantiation in all versions up to, and including, 5.3 via module parameter. This makes it possible for unauthenticated attackers to Instantiate a PHP Object. No known POP chain is present in the vulnerable software, which mean...

PT-2025-14844

Name of the Vulnerable Software and Affected Versions tagDiv Composer plugin for WordPress versions up to, and including, 5.3 Description The issue allows unauthenticated attackers to instantiate a PHP object via the module parameter. This vulnerability has no impact unless another plugin or them...

CVE-2024-13645: Improper Control of Generation of Code

The tagDiv Composer plugin for WordPress is vulnerable to PHP Object Instantiation in all versions up to, and including, 5.3 via module parameter. This makes it possible for unauthenticated attackers to Instantiate a PHP Object. No known POP chain is present in the vulnerable software, which mean...

CVE-2022-24989

TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. Shell metacharacters can be placed in raidtype because popen is used without any sanitization...

CVE-2022-24989: Improper Neutralization of Special Elements in Output Used by a Downstream Component

TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. Shell metacharacters can be placed in raidtype because popen is used without any sanitization...