CVE-2021-24579

The btbbgetgrid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize function without any validation or sanitisation, which could lead to a PHP Object Injection. Even though the plugin did not contain a suitable gadget to fully exploit the issu...

Design/Logic Flaw

The btbbgetgrid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize function without any validation or sanitisation, which could lead to a PHP Object Injection. Even though the plugin did not contain a suitable gadget to fully exploit the issu...

CVE-2021-24579

CVE-2021-24579 affects the Bold Page Builder WordPress plugin (before 3.1.6). The bt_bb_get_grid AJAX action passes user input to unserialize() without validation, enabling PHP Object Injection. Although no gadget was found in the plugin itself to fully exploit, it could enable RCE in some scenar...

CVE-2021-24579 Bold Page Builder < 3.1.6 - PHP Object Injection

The btbbgetgrid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize function without any validation or sanitisation, which could lead to a PHP Object Injection. Even though the plugin did not contain a suitable gadget to fully exploit the issu...

WordPress 插件代码问题漏洞

WordPress Plugin is an open source application plugin for WordPress. A code issue vulnerability exists in the WordPress plugin Bold Page Builder prior to version 3.1.6, which stems from the plugin's btbbgetgrid AJAX operation passing user input into the unserialize function without any validation...

Pornhub: Deserialization of untrusted data at https://www.redtube.com/media/hls?s=data

The researcher was able to exploit a PHP Object Injection vulnerability which allowed him to execute remote commands on the server...

[SECURITY] [DLA 2731-1] wordpress security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2731-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta August 04, 2021 https://wiki.debian.org/LTS -...

Debian DLA-2731-1 : wordpress - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2731 advisory. One security issue affects WordPress, a weblog manager, versions between 3.7 and 5.7. This update fixes the following security issues: Object injection in PHPMaile...

Bold Page Builder < 3.1.6 - PHP Object Injection

The btbbgetgrid AJAX action of the plugin passes user input into the unserialize function without any validation or sanitisation, which could lead to a PHP Object Injection. Even though the plugin did not contain a suitable gadget to fully exploit the issue, other installed plugins on the blog...

Bold Page Builder < 3.1.6 - PHP Object Injection

The btbbgetgrid AJAX action of the plugin passes user input into the unserialize function without any validation or sanitisation, which could lead to a PHP Object Injection. Even though the plugin did not contain a suitable gadget to fully exploit the issue, other installed plugins on the blog...

WordPress Bold Page Builder plugin <= 3.1.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by dc11 in WordPress Bold Page Builder plugin versions = 3.1.5. Solution Update the WordPress Bold Page Builder plugin to the latest available version at least 3.1.6...

CVE-2021-36766

Concrete5 through 8.5.5 deserializes Untrusted Data. The vulnerable code is located within the controllers/singlepage/dashboard/system/environment/logging.php Logging::updatelogging method. User input passed through the logFile request parameter is not properly sanitized before being used in a ca...

CVE-2021-36766

Concrete5 through 8.5.5 deserializes Untrusted Data. The vulnerable code is located within the controllers/singlepage/dashboard/system/environment/logging.php Logging::updatelogging method. User input passed through the logFile request parameter is not properly sanitized before being used in a ca...

Code injection

Concrete5 through 8.5.5 deserializes Untrusted Data. The vulnerable code is located within the controllers/singlepage/dashboard/system/environment/logging.php Logging::updatelogging method. User input passed through the logFile request parameter is not properly sanitized before being used in a ca...

CVE-2021-36766

Concrete5 through 8.5.5 deserializes Untrusted Data. The vulnerable code is located within the controllers/singlepage/dashboard/system/environment/logging.php Logging::updatelogging method. User input passed through the logFile request parameter is not properly sanitized before being used in a ca...

CVE-2021-36766

Concrete5 through 8.5.5 deserializes Untrusted Data. The vulnerable code is located within the controllers/singlepage/dashboard/system/environment/logging.php Logging::updatelogging method. User input passed through the logFile request parameter is not properly sanitized before being used in a ca...

CVE-2021-36766

Concrete5 (CMS) up to version 8.5.5 is affected by CVE-2021-36766 due to insecure handling of user input in Logging::update_logging(). The logFile parameter is not sanitized before passing to file_exists(), enabling PHP Object Injection via the phar:// stream wrapper and potentially arbitrary PHP...

@2600hz/sds-react-native-components (>=0.1.0, <=1.8.1), @abdur-rakib/react-native-button (>=0.0.1, <=0.0.3) +626 more potentially affected by CVE-2020-1920 via react-native (>=0.63.0, <=0.64.0-rc.2)

react-native NPM version =0.63.0, =0.1.0, =0.0.1, =0.1.0, =2.5.0, =0.0.1, =1.0.0, =1.0.1-Alpha.0, =1.1.4, =1.0.0, =1.0.4, =1.0.3, =3.0.0, =1.2.1, =1.0.0, =1.0.3 and more Source cves: CVE-2020-1920 Source advisory: OSV:GHSA-7F53-FMMV-MFJV...

CVE-2021-24384

The joomsportmdload AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised user input from the shattr POST parameter, leading to a PHP Object Injection issue. Even though the plugin does not have a suitable gadget...

CVE-2021-24384

The joomsportmdload AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised user input from the shattr POST parameter, leading to a PHP Object Injection issue. Even though the plugin does not have a suitable gadget...