PHP-binary-bugs

Exploits AI POP Builder のアドバイザリ PHP バイナリバグのアドバイザリ集 unserialize における未修正の GMP 型混乱 アイデア: 遅延 wakeup をバイパスし、PHP = 5.6.40 の未修正の GMP 型混乱バグを悪用する POC ソース: GMPtypeconfPOC.php アドバイザリ CVE-2022-31626 の解析 アイデア: mysqlnd のヒープバッファオーバーフロー、PHP = 7.4.29 POC ソース: ./cve202231626remoteexploit/exploitpoc.py アドバイザリ 連絡先...

cotonti-commentswidget-poc

Cotonti CommentsWidget PHP オブジェクトインジェクション PoC Cotonti の CommentsWidget 実装で確認された PHP オブジェクトインジェクション問題に対する安全なローカル概念実証です。 脆弱性 プロジェクト: Cotonti 影響を受けるコンポーネント: plugins/comments/inc/CommentsWidget.php CWE: CWE-502 — 信頼できないデータのデシリアライズ CVE/候補: CAN-2026-2035973 / CVE-2026-71294 研究者: Harsh Raj Singhania...

CVE-2025-61505

CVE-2025-61505 – e107 CMS 2.x의 PHP 객체 주입 보고일: 2025년 9월 18일 CVE 할당일: 2025년 10월 9일 게시일: 2026년 2월 2일 CVE ID: CVE-2025-61505 발견자: Anas Abderrahman Benbarek 요약 e107 CMS 버전 2.3.3의 설치 스크립트install.php에서 PHP 객체 주입 취약점CWE-502: 신뢰할 수 없는 데이터의 역직렬화이 발견되었습니다. 이 취약점으로 인해 인증되지 않은 원격 공격자가 악의적인 직렬화 데이터를 조작하여 e107...

CVE-2026-95806

MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point. The phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences: - any filesystem operation on a caller-influenced path that resolves to a...

The vulnerability of the unserialize() function in the SessionMaker CMS system, October CMS, allows a hacker to execute arbitrary code.

The vulnerability of the unserialize function in the SessionMaker CMS system, October CMS, is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

php:php-fuzz-unserialize: Use-of-uninitialized-value in zim_Time_Duration___unserialize

Detailed Report: https://oss-fuzz.com/testcase?key=6431772334948352 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-unserialize Job Type: libfuzzermsanphp Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: zimTimeDurationunserialize zendcallfunction...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the ci parameter in the GET request, which is passed to the unserialize function without restricting allowed classes. An attacker can execute arbitrary code or manipulate the database by supplying a...

CVE-2026-91939

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize without allowedclasses restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads ...

CVE-2026-91939 Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize without allowedclasses restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads ...

CVE-2026-91939 Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize without allowedclasses restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads ...

CVE-2026-91939

Cotonti 1.0.0 Comments plugin passes the ci GET parameter directly to unserialize() without an allowed_classes restriction. This allows unauthenticated attackers to inject arbitrary PHP objects via crafted serialized payloads, triggering gadget chains that can lead to database manipulation or rem...

EUVD-2026-80000

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize without allowedclasses restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads ...

CVE-2026-91939: Deserialization of Untrusted Data

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize without allowedclasses restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads ...

PT-2026-93177

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize without allowed classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads...

CVE-2026-49400

October System provides the system module for October Content Management System. Prior to versions 3.7.17 and 4.2.21, the backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowedclasses restriction. Any code path that could...

CVE-2026-61701

Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magiclinks.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php...

CVE-2026-49400 October CMS: PHP Object Injection via Backend Widget Session Storage

October System provides the system module for October Content Management System. Prior to versions 3.7.17 and 4.2.21, the backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowedclasses restriction. Any code path that could...

CVE-2026-49400 October CMS: PHP Object Injection via Backend Widget Session Storage

October System provides the system module for October Content Management System. Prior to versions 3.7.17 and 4.2.21, the backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowedclasses restriction. Any code path that could...

CVE-2026-49400

October CMS (System module) prior to v3.7.17 and v4.2.21 is affected by a PHP object injection vulnerability in the backend SessionMaker trait, which stored widget session state as base64(serialize(...)) and deserialized it with unserialize() without an allowed_classes restriction. Exploitation r...

GHSA-2FF2-MX52-Q8WP October CMS: PHP Object Injection via Backend Widget Session Storage

The backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowedclasses restriction. Any code path that could write to a widget. session key with attacker-controlled bytes could trigger PHP object injection the next time the widg...