CVE-2026-82222-MassExploit

CVE-2026-82222 — GiveWP WordPress Plugin Unauthenticated RCE -red.svg Critical Unauthenticated Remote Code Execution CVSS 9.8 — GiveWP ≤ 4.16.7.1 This tool exploits CVE-2026-82222 , a vulnerability in the WordPress GiveWP plugin that allows unauthenticated attackers to execute arbitrary commands ...

CVE-2021-43503

Warning The vulnerability has been revoked Override This is Abount CVE-2021-43503, I can not replicate this vulnerability through exp Requirement PHP 7.1. Composer registrar=$b; namespace Illuminate\Queue\Capsule class Manager protected $manager; public function construct$c $this-manager-method=$...

Laravel-vul

Laravel-vul A POP chain discovered during personal audit of Laravel 5, Vulnerability ID: CVE-2021-43503 Details see issues...

CVE-2024-56058

CVE-2024-56058 VRPConnector = 2.0.1 - Inyección de Objetos PHP sin Autenticación Descripción El plugin VRPConnector para WordPress es vulnerable a la Inyección de Objetos PHP en versiones hasta la 2.0.1 inclusive mediante la deserialización de entrada no confiable. Esto permite que atacantes no...

CVE-2026-78175

Tutor LMS (WordPress eLearning plugin) is vulnerable to PHP Object Injection in versions up to and including 4.0.7 via the withdraw_method_field parameter of the tutor_save_withdraw_account AJAX handler. The handler relies solely on a nonce without capability checks, and a flaw in how esc_sql() h...

CVE-2024-56059

CVE-2024-56059 Partners = 0.2.0 - Inyección de Objetos PHP No Autenticada Descripción El plugin Partners para WordPress es vulnerable a la Inyección de Objetos PHP en versiones hasta la 0.2.0 inclusive, a través de la deserialización de entrada no confiable. Esto permite que atacantes no...

CVE-2026-11363

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

CVE-2019-9081_PoC

CVE-2019-9081poc Poc para CVE-2019-9081, este CVE es solo una nueva cadena POP. El proyecto es una aplicación Laravel 5.7.x vulnerable preconstruida con un punto de entrada para la vulnerabilidad POI en la URI /deserialize solicitud POST. Configuración del laboratorio: Iniciando la aplicación...

CVE-2019-9081_PoC

CVE-2019-9081poc PoC для CVE-2019-9081, эта CVE представляет собой новую POP-цепочку. Проект представляет собой предварительно собранное уязвимое приложение Laravel 5.7.x с точкой входа для уязвимости POI по URI /deserialize POST-запрос. Настройка лаборатории: Запуск уязвимого приложения:...

CVE-2020-28032_PoC

CVE-2020-28032PoC PoC para CVE-2020-28032 Es solo una cadena POP en WordPress RequestsUtilityFilteredIterator Object callback:protected = system storage:ArrayIterator:private = Array 0 = id uid=1000nth347 gid=1000nth347...

CVE-2026-82222

CVE-2026-82222 — GiveWP Author: Rx019 CVSS: 10.0 Critical Type: Unauthenticated PHP Object Injection → Remote Code Execution Plugin: GiveWP give — Donation Plugin and Fundraising Platform Affected: Patched: 4.16.8 Description GiveWP stores a donor's lastname in the PHP session without sanitizatio...

CVE-2026-10196

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handleformsubmission' function. This makes it possible for...

CVE-2026-10196

The Mail Mint WordPress plugin (Email Marketing, Newsletter, Email Automation & WooCommerce Emails) is affected by an unauthenticated PHP Object Injection in all versions up to and including 1.31.0 . The root cause is deserialization of untrusted input in the handle_form_submission function, whic...

CVE-2026-19887

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback uscesactionactingtransaction. Unauthenticated attackers can store arbitrary 'reserve' key/value...

CVE-2026-19887

The Welcart e-Commerce plugin for WordPress (versions up to 2.12.1 ) is vulnerable to PHP Object Injection via the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenticated attackers can store arbitrary serialized data as order metadata during a public checkout, then trigger...

CVE-2026-14558

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...

CVE-2026-78572

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...

EUVD-2026-65355

The Kalles Addons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.6 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...

CVE-2026-78572

The Kalles Addons plugin for WordPress (versions up to and including 1.0.6 ) is vulnerable to PHP Object Injection via deserialization of untrusted input, allowing unauthenticated attackers to inject a PHP Object. No known POP chain exists within the plugin itself, so impact depends on whether an...

CVE-2026-78572

...