CVE-2026-76834: Deserialization of Untrusted Data

b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901 where the serialized-array object check in paramcheckserializedarray fails to reject payloads with negative integer array keys. Unauthenticated attackers can submit crafted serialized PHP objects via POST...

PT-2026-94367

Name of the Vulnerable Software and Affected Versions b2evolution CMS versions 6.7.8 through 7.2.5 Description An incomplete fix in the param check serialized array function fails to reject payloads containing negative integer array keys. Unauthenticated attackers can send crafted serialized PHP...

EUVD-2007-0179

Malware in sbrugna...

Design/Logic Flaw

b2evolution 6.7.6 suffer from an Object Injection vulnerability in /htsrv/callplugin.php...

CVE-2016-8901

b2evolution 6.7.6 suffer from an Object Injection vulnerability in /htsrv/callplugin.php...

CVE-2016-8901

CVE-2016-8901 affects b2evolution 6.7.6 with an Object Injection vulnerability in /htsrv/call_plugin.php. CVSS3 base score 9.8 (CRITICAL) indicates high-impact, network-exposed, no authentication, and potential for full system compromise; however exploitation details are not provided in the conne...

CVE-2016-8901

b2evolution 6.7.6 suffer from an Object Injection vulnerability in /htsrv/callplugin.php...

PT-2019-7851

Name of the Vulnerable Software and Affected Versions b2evolution version 6.7.6 Description The issue is related to an Object Injection in the /htsrv/call plugin.php endpoint. Recommendations For version 6.7.6, update to a newer version that contains a fix for this issue...

CVE-2012-5910

SQL injection vulnerability in blogs/htsrv/viewfile.php in b2evolution 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via the root parameter...

PT-2012-6191

Name of the Vulnerable Software and Affected Versions b2evolution version 4.1.3 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the root parameter in the /blogs/htsrv/viewfile.php API endpoint. Recommendations For version 4.1.3,...

Cross site scripting

Cross-site scripting XSS vulnerability in htsrv/login.php in b2evolution 1.8.6 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes in the redirectto parameter...

CVE-2007-0175: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in htsrv/login.php in b2evolution 1.8.6 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes in the redirectto parameter...

CVE-2007-0175

CVE-2007-0175 describes an XSS vulnerability in b2evolution 1.8.6, where the htsrv/login.php script accepts scriptable attributes in the redirect_to parameter to inject arbitrary HTML/JS. Connected records corroborate remote cross-site scripting due to insufficient input sanitising. Debian/DSA-15...