cotonti-commentswidget-poc

PoC de inyección de objetos PHP en Cotonti CommentsWidget Prueba de concepto local segura para el problema de inyección de objetos PHP identificado en la implementación de CommentsWidget de Cotonti. Vulnerabilidad Proyecto: Cotonti Componente afectado: plugins/comments/inc/CommentsWidget.php CWE:...

CVE-2026-91939 Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize without allowedclasses restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads ...

CVE-2026-91939 Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize without allowedclasses restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads ...

CVE-2026-91939

Cotonti 1.0.0 Comments plugin passes the ci GET parameter directly to unserialize() without an allowed_classes restriction. This allows unauthenticated attackers to inject arbitrary PHP objects via crafted serialized payloads, triggering gadget chains that can lead to database manipulation or rem...

Human Resource Management System 安全漏洞

Human Resource Management System is a human resource management system by maverickosama Personal Developer. A security vulnerability exists in Human Resource Management System, which stems from an unknown part of its getstatecity.php component where manipulation of the ci parameter can lead to SQ...

SQL injection vulnerability in the ci*** parameter of the cm***.php page of the 100 Vail Virtual Reality Cloud Platform for Vocational Education

100 Vail Vocational Education Virtual Reality Cloud Platform is a handheld skill learning platform for workplace competency development. There is a SQL injection vulnerability in the ci parameter of the cm.php page of the 100Vail Virtual Reality Cloud Platform for Vocational Education, which can ...

CVE-2006-6247

Multiple SQL injection vulnerabilities in Uapplication UPhotoGallery 1.1 allow remote attackers to execute arbitrary SQL commands via the ci parameter to 1 slideshow.asp or 2 thumbnails.asp...