35460 matches found
EUVD-2026-48112
Unauthenticated Insecure Direct Object References IDOR in Shiptastic for WooCommerce = 5.1.0 versions...
CVE-2026-65501
CVE-2026-65501 affects the WordPress plugin Shiptastic for WooCommerce (versions
EUVD-2026-48108
Administrator PHP Object Injection in Complianz = 7.5.0 versions...
CVE-2026-65497
CVE-2026-65497 concerns the WordPress Complianz plugin, affected in versions ≤ 7.5.0, with a PHP Object Injection vulnerability identifiable under the described Administrator context. The root cause is a PHP object injection flaw within Complianz that could be exploited via a network attack vecto...
EUVD-2026-48104
Subscriber PHP Object Injection in Dokan Pro = 5.0.2 versions...
CVE-2026-65493
The CVE-2026-65493 entry concerns the WordPress Dokan Pro plugin (
EUVD-2026-48075
Subscriber Insecure Direct Object References IDOR in Masteriyo - LMS = 2.3.1 versions...
CVE-2026-65463
CVE-2026-65463 affects the WordPress Masteriyo LMS plugin, versioned up to 2.3.1, with an Insecure Direct Object References (IDOR) vulnerability in Subscriber scope. The entry provides a CVSS 3.1 base score of 5.4 (Medium) with network attack vector, low attack complexity, and requires low privil...
EUVD-2026-48221
Contributor Insecure Direct Object References IDOR in Product Slider for WooCommerce = 1.13.62 versions...
EUVD-2026-48204
Unauthenticated Insecure Direct Object References IDOR in Easy Appointments = 3.12.27 versions...
CVE-2026-61946
WordPress Easy Appointments plugin
EUVD-2026-48197
Unauthenticated PHP Object Injection in Thrive Quiz Builder = 10.9.3.0 versions...
CVE-2026-59544
The CVE covers WordPress Thrive Quiz Builder plugin versions
Revive Adserver 4.2 - Remote Code Execution
Revive Adserver 4.2 is susceptible to remote code execution. An attacker can send a crafted payload to the XML-RPC invocation script and trigger the unserialize call on the "what" parameter in the "openads.spc" RPC method. This can be exploited to perform various types of attacks, e.g...
GiveWP - PHP Object Injection
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'givetitle' parameter. id: CVE-2024-5932 info: name: GiveWP - PHP Object Injection author:...
GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1. This is due to insufficient input validation on user-supplied data. An unauthenticated attacker can inject a serialized PHP object, which...
Better Search Replace < 1.4.5 - PHP Object Injection
The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. I...
OpenMRS Platform < 2.24.0 - Insecure Object Deserialization
OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body. id: CVE-2018-19276 info: name: OpenMRS Platform 2.24.0 - Insecure Object...
CrushFTP < 10.5.1 - Unauthenticated Remote Code Execution
CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes. id: CVE-2023-43177 info: name: CrushFTP 10.5.1 - Unauthenticated Remote Code Execution author: iamnoooob,rootxharsh,pdresearch severity: critical description: | CrushFTP prior...
