CVE-2024-12742

A deserialization of untrusted data vulnerability exists in NI G Web Development Software that may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects G Web Development Software 2022 Q3...

WordPress plugin Gallery by BestWebSoft 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in WordPres...

CVE-2025-2043 LinZhaoguan pb-cms Add New Topic admin#themes deserialization

A vulnerability was found in LinZhaoguan pb-cms 1.0.0 and classified as critical. This issue affects some unknown processing of the file /adminthemes of the component Add New Topic Handler. The manipulation of the argument Topic Key leads to deserialization. The attack may be initiated remotely...

CVE-2024-12742

CVE-2024-12742 describes a deserialization of untrusted data vulnerability in NI G Web Development Software. Affected: NI G Web Development Software 2022 Q3 and earlier. The flaw exists in parsing of GWEBPROJECT files, with exploitation requiring a user to open a specially crafted project file or...

pb-cms 代码问题漏洞

pb-cms waterfall content management system is a content management system by LinZhaoguan Personal Developer. A code issue vulnerability exists in pb-cms version 1.0.0, which stems from an incorrect operation of the parameter Topic Key that can lead to deserialization...

CVE-2025-26999

Deserialization of Untrusted Data vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Object Injection.This issue affects ProfileGrid : from n/a through = 5.9.4.3...

CVE-2024-13787

CVE-2024-13787 affects VEDA – MultiPurpose WordPress Theme up to version 4.2. It is vulnerable to PHP Object Injection via deserialization in veda_backup_and_restore_action. Exploitation requires authenticated access (Subscriber+) and the base vulnerability has no POP chain in the theme itself; a...

CVE-2024-13787 VEDA - MultiPurpose WordPress Theme <= 4.2 - Authenticated (Subscriber+) PHP Object Injection

The VEDA - MultiPurpose WordPress Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2 via deserialization of untrusted input in the 'vedabackupandrestoreaction' function. This makes it possible for authenticated attackers, with Subscriber-leve...

CVE-2025-0956

CVE-2025-0956 affects the WooCommerce Recover Abandoned Cart plugin for WordPress (versions up to 24.3.0). It enables unauthenticated PHP Object Injection via deserialization of input from the raccookie_guest_email cookie. The vulnerability’s impact depends on the presence of a POP (PHP Object) c...

WordPress plugin VEDA 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

WordPress plugin WooCommerce Recover Abandoned Cart 输入验证错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin WooCommerc...

CVE-2025-0912

The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted input from the Donation Form through the 'cardaddress' parameter. This makes it possible for unauthenticated attackers to inject a PHP...

Picklescan Allows Remote Code Execution via Malicious Pickle File Bypassing Static Analysis

CVE-2025-1716 Summary An unsafe deserialization vulnerability in Python’s pickle module allows an attacker to bypass static analysis tools like Picklescan and execute arbitrary code during deserialization. This can be exploited to run pip install and fetch a malicious package, enabling remote cod...

CVE-2025-26885

Deserialization of Untrusted Data vulnerability in Beaver Builder WordPress Assistant assistant allows Object Injection.This issue affects WordPress Assistant: from n/a through = 1.5.1...

CVE-2025-26967

Deserialization of Untrusted Data vulnerability in Stiofan Events Calendar for GeoDirectory allows Object Injection. This issue affects Events Calendar for GeoDirectory: from n/a through 2.3.14...

CVE-2025-26885

CVE-2025-26885 is a deserialization of untrusted data vulnerability in the Beaver Builder WordPress Assistant plugin (Assistant) &lt;= 1.5.1. Root cause: PHP object injection via deserialization of untrusted data. Affected software: WordPress plugin Assistant – from n/a through

CVE-2025-26999

CVE-2025-26999 describes an authenticated PHP object injection (deserialization of untrusted data) in ProfileGrid (WordPress plugin) up to version 5.9.4.3. The vulnerability allows object injection via deserialization of untrusted data in ProfileGrid’s PHP code path. Public references from CVE re...

WordPress plugin Events Calendar for GeoDirectory 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in the...

WordPress plugin ProfileGrid 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

WordPress plugin Assistant 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...