5597 matches found
CVE-2025-39485
CVE-2025-39485 concerns the Grand Tour | Travel Agency WordPress theme deserializing untrusted data, enabling PHP object injection in versions up to 5.5.1. Public sources confirm a WordPress theme vulnerability with a critical CVSS 9.8, affecting the Grand Tour theme and labeled as unpatched in t...
CVE-2025-39480
CVE-2025-39480 describes a Deserialization of Untrusted Data vulnerability (PHP Object Injection) in ThemeMakers Car Dealer (WordPress theme) affected versions through 1.6.6. The issue enables object injection on unauthenticated access, with attacker‑controlled data potentially compromising confi...
CVE-2025-39485 WordPress GrandTour Theme <= 5.5.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Tour | Travel Agency WordPress allows Object Injection. This issue affects Grand Tour | Travel Agency WordPress: from n/a through 5.5.1...
CVE-2025-39495 WordPress Avantage Theme <= 2.4.6 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in BoldThemes Avantage allows Object Injection. This issue affects Avantage: from n/a through 2.4.6...
CVE-2025-39503
CVE-2025-39503 is a deserialization of untrusted data vulnerability in the WordPress plugin Goodlayers Hotel (Goodlayers Hotel), affecting versions up to and including 3.1.4. The issue enables PHP Object Injection. The cited CVSS v3.1 base score is 9.8 (CRITICAL) with network attack vector, no us...
CVE-2025-39503 WordPress Goodlayers Hotel plugin <= 3.1.4 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hotel allows Object Injection. This issue affects Goodlayers Hotel: from n/a through 3.1.4...
CVE-2025-47530 WordPress WPFunnels plugin <= 3.5.18 - PHP Object Injection Vulnerability
Deserialization of Untrusted Data vulnerability in WPFunnels WPFunnels wpfunnels allows Object Injection.This issue affects WPFunnels: from n/a through = 3.5.18...
CVE-2025-47530 WordPress WPFunnels <= 3.5.18 - PHP Object Injection Vulnerability
Deserialization of Untrusted Data vulnerability in WPFunnels WPFunnels allows Object Injection. This issue affects WPFunnels: from n/a through 3.5.18...
CVE-2025-48287 WordPress Pix 4x sem juros - Pagaleve plugin <= 1.6.9 - PHP Object Injection Vulnerability
Deserialization of Untrusted Data vulnerability in Pagaleve Pix 4x sem juros - Pagaleve wc-pagaleve allows Object Injection.This issue affects Pix 4x sem juros - Pagaleve: from n/a through = 1.6.9...
CVE-2025-48289
CVE-2025-48289 (WordPress Kids Planet) : Deserialization of untrusted data leading to PHP object injection in AncoraThemes Kids Planet, affecting versions up to 2.2.14. CVSS 3.1 base score 9.8 (CRITICAL) with high impact on confidentiality, integrity, and availability. Connected sources indicate ...
CVE-2025-48287
CVE-2025-48287 affects the WordPress plugin Pix 4x sem juros – Pagaleve (versions up to 1.6.9). It is a Deserialization of Untrusted Data vulnerability enabling PHP Object Injection. The CVSS v3.1 base score is 9.8 (Critical). Patch status in connected sources indicates the issue has been patched...
CVE-2024-47074
DataEase is an open source data visualization analysis tool. In Dataease, the PostgreSQL data source in the data source function can customize the JDBC connection parameters and the PG server target to be connected. In backend/src/main/java/io/dataease/provider/datasource/JdbcProvider.java,...
CVE-2024-8255
Delta Electronics DTN Soft version 2.0.1 and prior are vulnerable to an attacker achieving remote code execution through a deserialization of untrusted data vulnerability...
CVE-2024-4606
Deserialization of Untrusted Data vulnerability in BdThemes Ultimate Store Kit Elementor Addons.This issue affects Ultimate Store Kit Elementor Addons: from n/a through 2.0.3...
CVE-2024-37502
Deserialization of Untrusted Data vulnerability in wpweb WooCommerce Social Login woo-social-login.This issue affects WooCommerce Social Login: from n/a through = 2.6.3...
CVE-2024-3431
A vulnerability was found in EyouCMS 1.6.5. It has been declared as critical. This vulnerability affects unknown code of the file /login.php?m=admin=Field=channeledit of the component Backend. The manipulation of the argument channelid leads to deserialization. The attack can be initiated remotel...
CVE-2024-5649
The Universal Slider plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.5 via deserialization of untrusted input 'fslgetgalleryvalue' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject ...
CVE-2024-29433
A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying crafted data...
CVE-2024-36528
nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /admin/extensions/download.php and /admin/extensions/upload.php...