CVE-2022-2437 Feed Them Social – for Twitter feed, Youtube and more <= 2.9.8.5 - Unauthenticated PHAR Deserialization

The Feed Them Social – for Twitter feed, Youtube and more plugin for WordPress is vulnerable to deserialization of untrusted input via the 'ftsurl' parameter in versions up to, and including 2.9.8.5. This makes it possible for unauthenticated attackers to call files using a PHAR wrapper that will...

CVE-2022-2437

CVE-2022-2437 affects the WordPress plugin Feed Them Social (versions up to and including 2.9.8.5). The vulnerability is described as deserialization of untrusted input through the fts_url parameter, enabling an unauthenticated attacker to trigger a PHAR wrapper to deserialize data and invoke arb...

CVE-2022-2444 Visualizer: Tables and Charts Manager for WordPress <= 3.7.9 - Authenticated (Contributor+) PHAR Deserialization

The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrusted input via the 'remotedata' parameter in versions up to, and including 3.7.9. This makes it possible for authenticated attackers with contributor privileges and above to call...

CVE-2022-2444

The CVE-2022-2444 issue affects the WordPress plugin Visualizer (Tables and Charts Manager) up to version 3.7.9. It hinges on deserialization of untrusted input via the remote_data parameter, allowing authenticated attackers with contributor privileges to upload a payload that can be executed thr...

PT-2022-16697 · WordPress · The Visualizer: Tables/Charts Manager For Wordpress

Name of the Vulnerable Software and Affected Versions: The Visualizer: Tables and Charts Manager for WordPress versions up to, and including 3.7.9 Description: The issue concerns deserialization of untrusted input via the remote data parameter. This allows authenticated attackers with contributor...

WordPress plugin Feed Them Social 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Feed Them...

PT-2022-16649 · WordPress · Feed Them Social

Name of the Vulnerable Software and Affected Versions: Feed Them Social – for Twitter feed, Youtube and more plugin for WordPress versions up to, and including 2.9.8.5 Description: The issue allows deserialization of untrusted input via the fts url parameter. This enables unauthenticated attacker...

Feed Them Social < 2.9.8.6 - Unauthenticated PHAR Deserialisation

The plugin does not validate the ftsurl parameter, which could lead to PHAR deserialisation when an attacker manage to upload a malicious file and a suitable gadget chain is present...

WordPress Feed Them Social plugin <= 2.9.8.5 - Unauthenticated PHAR Deserialization vulnerability

Unauthenticated PHAR Deserialization vulnerability discovered by Rasoul Jahanshahi in WordPress Feed Them Social plugin versions = 2.9.8.5. Solution Update the WordPress Feed Them Social plugin to the latest available version at least 2.9.8.6...

WordPress Visualizer plugin <= 3.7.9 - Authenticated PHAR Deserialization vulnerability

Authenticated PHAR Deserialization vulnerability discovered by Rasoul Jahanshahi in WordPress Visualizer plugin versions = 3.7.9. Solution Update the WordPress Visualizer plugin to the latest available version at least 3.7.10...

Visualizer: Tables and Charts Manager for WordPress < 3.7.10 - Contributor+ PHAR Deserialization

The plugin does not validate the ‘remotedata’ parameter allowing contributor and above roles to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP objects when a POP chain is present...

PT-2023-12337

Name of the Vulnerable Software and Affected Versions DomPDF versions prior to 2.0.0 Description The issue is related to PHAR deserialization due to a lack of checking on the protocol before passing it into the file get contents function. An attacker who can upload files of any type to the server...

CVE-2021-40604

A Server-Side Request Forgery SSRF vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In some cases an exploitation is possible by an unauthenticated us...

CVE-2021-40604

A Server-Side Request Forgery SSRF vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In some cases an exploitation is possible by an unauthenticated us...

CVE-2021-40604

A Server-Side Request Forgery SSRF vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In some cases an exploitation is possible by an unauthenticated us...

Server side request forgery (ssrf)

A Server-Side Request Forgery SSRF vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In some cases an exploitation is possible by an unauthenticated us...

CVE-2021-40604

A Server-Side Request Forgery SSRF vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In some cases an exploitation is possible by an unauthenticated us...

CVE-2021-40604

CVE-2021-40604 affects IPS Community Suite prior to 4.6.2, where an SSRF vulnerability exists that can be triggered by remote authenticated users, with possible unauthenticated exploitation in some cases. The root cause involves dynamic class-name generation that can trigger deserialization via t...

Invision Community 代码问题漏洞

Invision Community is a software for designing and developing mobile application UI from Invision, Inc. A security vulnerability exists in Invision Community versions prior to 4.6.2 that originates from allowing a remote authenticated user to request arbitrary URLs or trigger deserialization via...

GHSA-XX77-W6P5-XVMJ ShopXO RCE Vulnerability

A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is uploaded after modifying the phar suffix...