Arbitrary Object Creation And Arbitrary Code Execution

mathjs is vulnerable to arbitrary object creation and arbitrary code execution attacks. The attacks exist because it does not properly check whether the methods being called are safe methods i.e., the method being called is not defined on the the prototype of the native object. For example,...

Subrion CMS PHP Object Injection Vulnerability

Subrion CMS is an open source content management system CMS. Subrion CMS suffers from a PHP object injection vulnerability that stems from a failure to adequately validate user input. An attacker can use this vulnerability to inject arbitrary objects into the application, delete files, view files...

CubeCart 5.2.0 PHP Object Injection

------------------------------------------------------------------------- CubeCart set'shipping', unserializebase64urldecode$POST'shipping'; 522. if !isset$POST'proceed' 523. httpredircurrentPage; 524. 525. User input passed through the $POST'shipping' parameter is not properly sanitized before...