CVE-2025-54014

CVE-2025-54014 is a deserialization/ PHP Object Injection vulnerability in the MediCenter - Health Medical Clinic WordPress Theme (vulnerable:

CVE-2025-54053

CVE-2025-54053 – Groundhogg PHP Object Injection . The vulnerability is caused by deserialization of untrusted data in Groundhogg (WordPress plugin) and is exploitable through versions up to and including 4.2.2. This leads to PHP object injection as described in external advisories. The Red Hat/P...

CVE-2025-8289

CVE-2025-8289 affects the WordPress plugin Redirection for Contact Form 7, vulnerable to unauthenticated PHP Object Injection via PHAR deserialization in delete_associated_files, for versions up to 3.2.4. Exploitation requires a form with a file upload action and the extension “Redirection For Co...

CVE-2025-8145 Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the getleadfields function. This makes it possible for unauthenticated attackers to inject a PHP Object. The addition...

CVE-2025-8145 Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the getleadfields function. This makes it possible for unauthenticated attackers to inject a PHP Object. The addition...

Schneider Electric EcoStruxure Power Monitoring Expert和EcoStruxure Power Operation AdvancedReporting and Dashboards Module 代码问题漏洞

Schneider Electric EcoStruxure Power Monitoring Expert and EcoStruxure Power Operation AdvancedReporting and Dashboards Module are products of Schneider Electric, France. Schneider Electric EcoStruxure Power Monitoring Expert is a device for power distribution monitoring in IoT...

PT-2025-33981 · Unknown · Rascals Noisa

Name of the Vulnerable Software and Affected Versions: rascals Noisa versions through 2.6.0 Description: A deserialization of untrusted data issue in rascals Noisa allows object injection. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...

Linux Distros Unpatched Vulnerability : CVE-2018-1000873

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a...

WordPress plugin和WordPress 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2025-33956 · Unknown · Simple-Login-Log

Name of the Vulnerable Software and Affected Versions: Simple Login Log versions through 1.1.3 Description: Deserialization of untrusted data in Simple Login Log allows object injection. Recommendations: Update Simple Login Log to a version later than 1.1.3...

WordPress plugin Welcart e-Commerce 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-33978 · Thememakers · Visual Content Composer

Name of the Vulnerable Software and Affected Versions: ThemeMakers Visual Content Composer versions through 1.5.8 Description: ThemeMakers Visual Content Composer is susceptible to object injection due to the deserialization of untrusted data. Recommendations: Update ThemeMakers Visual Content...

PT-2025-34016 · Unknown · Groundhogg

Name of the Vulnerable Software and Affected Versions: Groundhogg versions through 4.2.2 Description: Deserialization of untrusted data in Groundhogg allows object injection. Recommendations: Update Groundhogg to a version later than 4.2.2...

PT-2025-33999 · Unknown · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce versions through 2.11.16 Description: A deserialization of untrusted data issue exists in Welcart e-Commerce, allowing for object injection. Recommendations: Update Welcart e-Commerce to a version later than 2.11.16...

WordPress plugin Groundhogg 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Linux Distros Unpatched Vulnerability : CVE-2018-14721

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery SSRF attacks by leveraging failure to block the...

Linux Distros Unpatched Vulnerability : CVE-2018-6162

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper deserialization in WebGL in Google Chrome on Mac prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted...

PT-2025-33997 · WordPress · Gutenberg Blocks +1

Name of the Vulnerable Software and Affected Versions: PickPlugins Post Grid and Gutenberg Blocks versions through 2.3.11 Description: Deserialization of untrusted data in PickPlugins Post Grid and Gutenberg Blocks allows for object injection. Recommendations: Versions prior to 2.3.11 are affecte...

Linux Distros Unpatched Vulnerability : CVE-2018-14718

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from...

PT-2025-33729 · Volcengine · Volcengine Verl

Name of the Vulnerable Software and Affected Versions: Volcengine versions 3.0.0 Description: A deserialization vulnerability exists in Volcengine's scripts/model merger.py script when using the "fsdp" backend. The script calls torch.load with weights only=False on user-supplied .pt files, allowi...