CVE-2021-43503

تحذير تم إلغاء الثغرة تجاوز هذا يتعلق بـ CVE-2021-43503، لم أتمكن من تكرار هذه الثغرة من خلال exp المتطلبات PHP 7.1. Composer registrar=$b; namespace Illuminate\Queue\Capsule class Manager protected $manager; public function construct$c $this-manager-method=$c; namespace Mockery class...

CVE-2019-9081_PoC

CVE-2019-9081poc إثبات المفهوم لـ CVE-2019-9081، هذا CVE هو مجرد سلسلة POP جديدة. المشروع هو تطبيق Laravel 5.7.x ضعيف مسبق البناء مع نقطة دخول لثغرة POI في المسار /deserialize طلب POST. إعداد المختبر: بدء تشغيل التطبيق الضعيف: root@kitploit: $ git clone...

CVE-2019-9081_PoC

CVE-2019-9081poc إثبات اختراق لـ CVE-2019-9081، هذه الثغرة هي مجرد سلسلة POP جديدة. المشروع هو تطبيق Laravel 5.7.x معرض للخطر مبني مسبقًا مع نقطة دخول لثغرة POI في URI /deserialize طلب POST. إعداد المختبر: بدء التطبيق المعرض للخطر: root@kitploit: $ git clone...

CVE-2020-28032_PoC

CVE-2020-28032PoC PoC pour CVE-2020-28032 C'est simplement une chaîne POP dans WordPress RequestsUtilityFilteredIterator Object callback:protected = system storage:ArrayIterator:private = Array 0 = id uid=1000nth347 gid=1000nth347...

Laravel-vul

Laravel-vul سلسلة POP لـ Laravel 5 تم اكتشافها من خلال التدقيق الشخصي، رقم الثغرة: CVE-2021-43503 انظر التفاصيل في issues...

CVE-2026-78572

The Kalles Addons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.6 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...

CVE-2026-78572

The Kalles Addons plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input in all versions up to and including 1.0.6 . An unauthenticated attacker can inject a PHP object. No known POP chain exists within the plugin itself, so the vulnerability has no impa...

EUVD-2026-65355

The Kalles Addons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.6 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...

CVE-2024-56058

CVE-2024-56058 VRPConnector = 2.0.1 - Injection d'objet PHP non authentifiée Description Le plugin VRPConnector pour WordPress est vulnérable à l'injection d'objet PHP dans les versions jusqu'à 2.0.1 incluse via la désérialisation d'entrées non fiables. Cela permet à des attaquants non authentifi...

CVE-2024-56059

CVE-2024-56059 Partners = 0.2.0 - PHP Object Injection без аутентификации Описание Плагин Partners для WordPress уязвим к PHP Object Injection в версиях до 0.2.0 включительно из-за десериализации недоверенных входных данных. Это позволяет неаутентифицированным атакующим внедрить PHP-объект. В...

CVE-2024-13784

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2024-13784

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

EUVD-2024-55720

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2024-13784 Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2024-13784

The CVE-2024-13784 entry concerns the WordPress plugin ARForms (Contact Form, Survey, Quiz & Popup Form Builder). Affected versions: all up to and including 1.8.5. Root cause: PHP Object Injection via deserialization of untrusted input from form submissions. Impact requires that a POP chain exist...

CVE-2026-10035

The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted input in the wvrbbpsettoserializedvalues function reached through the wvrbbpsaverestore settings-restore handler. The function...

CVE-2026-71294 Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions

Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via trim-only sanitization is passed to with no restriction, reachable by any member with wri...

EUVD-2026-37585

The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level...

CVE-2026-12115

The vulnerability CVE-2026-12115 affects the WordPress plugin Counter Box (versions up to 2.0.13). It allows PHP Object Injection via deserialization of untrusted input and requires authenticated access at Administrator+ level. Deserialization occurs automatically during the post-import redirect ...

CVE-2026-7566

The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.4 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP...