323 matches found
PT-2025-43965
Name of the Vulnerable Software and Affected Versions Rox affected versions not specified Description The software contains a PHP object injection issue due to deserialization of untrusted data. User-controlled input, specifically the formkit memory recovery POST parameter in...
CVE-2017-20207
The Flickr Gallery plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.5.2 via deserialization of untrusted input from the pager parameter. This allows unauthenticated attackers to inject a PHP Object. Attackers were actively exploiting this vulnerabilit...
CVE-2017-20206 Appointments <= 2.2.1 - Unauthenticated PHP Object Injection
The Appointments plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.2.1 via deserialization of untrusted input from the wpmudevappointments cookie. This allows unauthenticated attackers to inject a PHP Object. Attackers were actively exploiting this...
CVE-2017-20207
The Flickr Gallery plugin for WordPress (versions up to and including 1.5.2 ) is vulnerable to PHP Object Injection . The root cause is the deserialization of untrusted input from the pager parameter, which allows unauthenticated attackers to inject a PHP Object. This vulnerability has been activ...
EUVD-2018-10073
Malware in sbrugna...
EUVD-2021-11377
Malware in sbrugna...
EUVD-2016-8264
Malware in sbrugna...
EUVD-2005-0224
Malware in sbrugna...
EUVD-2021-0845
Malware in sbrugna...
EUVD-2024-31891
Malicious code in bioql PyPI...
EUVD-2023-33660
Malicious code in bioql PyPI...
EUVD-2022-52239
Malicious code in bioql PyPI...
📄 EasyApp Limited 2.5 Remote Code Execution / Deserialization / File Upload
EasyApp Limited versions 2.5 and below suffer from PHP object injection allowing for remote code execution, arbitrary file upload, and hardcoded credential vulnerabilities. It looks like it may also suffer from cross site request forgery, cross site scripting, etc. Obviously, security is hard, an...
CVE-2025-8289
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the deleteassociatedfiles function. This makes it possible for unauthenticated attackers to inject a PHP Object. This...
Zimbra Collaboration Server < 8.7.11 Patch 9, 8.8 < 8.8.9 Patch 10, 8.8.10 < Patch 7, 8.8.11 < Patch 3
According to its self-reported version number, Zimbra Collaboration Server is affected by an object derserialization vulnerability in the IMAP componet. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 8090...
PT-2025-28282 · Sap · Sap Netweaver Application Server For Java Log Viewer
Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application server for Java affected versions not specified Description: A critical issue in the Log Viewer component enables authenticated administrator users to exploit unsafe Java object deserialization. Successful exploitati...
Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : Roundcube vulnerability (USN-7584-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 host has packages installed that are affected by a vulnerability as referenced in the USN-7584-1 advisory. It was discovered that Roundcube Webmail did not properly sanitize the from parameter in a URL,...
Ubuntu: Security Advisory (USN-7584-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-7584-1: Roundcube vulnerability
It was discovered that Roundcube Webmail did not properly sanitize the from parameter in a URL, leading to PHP Object Deserialization. A remote attacker could possibly use this issue to execute arbitrary code...
