CVE-2025-3439

The CVE-2025-3439 entry describes a PHP Object Injection in Everest Forms for WordPress up to version 3.1.1, achieved via deserialization of untrusted input in the field_value parameter. Attackers can inject a PHP object, but impact depends on whether a POP (object payload) chain exists in anothe...

CVE-2025-3439 Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress <= 3.1.1 - Unauthenticated PHP Object Injection

The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.1 via deserialization of untrusted input from the 'fieldvalue' parameter. This makes it possible for...

CVE-2025-32569

Deserialization of Untrusted Data vulnerability in RealMag777 TableOn posts-table-filterable allows Object Injection.This issue affects TableOn: from n/a through = 1.0.4.3...

CVE-2025-32143

Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through = 2.3.11...

CVE-2025-32607

CVE-2025-32607 describes a Deserialization of Untrusted Data vulnerability (PHP object injection) in the WordPress plugin WpBookingly (Service Booking & Scheduling Solution). Affected versions:

CVE-2025-32568

CVE-2025-32568: EmpikPlace for Woocommerce suffers authenticated PHP Object Injection via deserialization (deserialization of untrusted data). Affected: EmpikPlace for Woocommerce versions up to 1.4.2 (and up to 1.4.3 per Wordfence), with the issue exploitable by authenticated subscribers. Impact...

CVE-2025-32143 WordPress Accordion plugin <= 2.3.11 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through = 2.3.11...

CVE-2025-32143

CVE-2025-32143 affects the Accordion plugin for WordPress (PickPlugins Accordion). It is a Deserialization of Untrusted Data vulnerability leading to PHP Object Injection. The advisory covers Accordion versions from 2.0 up to 2.3.10 (n/a through 2.3.10). The CVSS v3.1 base score is 8.8 (High) wit...

CVE-2025-32144

CVE-2025-32144 – Job Board Manager (WordPress) PHP Object Injection : Authenticated PHP Object Injection via deserialization of untrusted data in PickPlugins Job Board Manager. Affected: Job Board Manager

WordPress plugin Job Board Manager 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

WordPress plugin Accordion 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

WordPress plugin TableOn 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

CVE-2025-3425

The IntelliSpace portal application utilizes .NET Remoting for its functionality. The vulnerability arises from the exploitation of port 755 through the deserialization vulnerability. After analyzing the configuration files, we observed that the server had set the TypeFilterLevel to Full which is...

CVE-2025-30284

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass security protections...

EUVD-2025-11917

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user resulting in a High impact to Confidentiality and Integrity. Exploitation of this issue does...

Adobe ColdFusion 代码问题漏洞

Adobe ColdFusion is a suite of rapid application development platforms from the American company Audobee Adobe. The platform includes an integrated development environment and a scripting language. A code issue vulnerability exists in Adobe ColdFusion 2023.12, 2021.18, 2025.0 and prior versions...

Microsoft Office Sharepoint Server 代码问题漏洞

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A remote code executi...

springboot-admin 安全漏洞

springboot-admin is a shiro cms solution by opplus individual developers. A security vulnerability exists in springboot-admin, which stems from the fact that incorrect manipulation of the parameter Tables can lead to deserialization...

PT-2025-15578 · Microsoft · Sharepoint Server

Name of the Vulnerable Software and Affected Versions: Microsoft Office SharePoint affected versions not specified Description: The issue allows an authorized attacker to execute code over a network by deserializing untrusted data. This enables remote attackers to execute arbitrary code and affec...

Picklescan failed to detect to some unsafe global function in Numpy library

Summary An unsafe deserialization vulnerability in Python’s pickle module allows an attacker to bypass static analysis tools like Picklescan and execute arbitrary code during deserialization. This can be exploited by import some built-in function in Numpy library that indrectly call some dangerou...