CVE-2024-52433

CVE-2024-52433 My Geo Posts Free = 1.2 - Unauthenticated PHP Object Injection Description The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated...

CVE-2024-12877-Exploit

GO-TO CVE – CVE-2024-12877-Exploit Week 66 | Author: Ali Soltani soltanali0 Welcome to Week 66 of the GO-TO CVE series , where we dissect vulnerabilities, analyze root causes, and demonstrate practical exploitation techniques in a safe, educational context. 🚨 Overview CVE-2024-12877 is a PHP Obje...

Mintinstall-object-injection

TR El administrador de software de Linux Mint v 7.9.5/9 provoca la ejecución de inyección de objetos y código arbitrario debido a una configuración incorrecta. EN El administrador de software de Linux Mint v 7.9.5/9 nos hace ejecutar inyección de objetos y código arbitrario debido a una...

WordPress VK Google Job Posting Manager plugin <= 1.3.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin VK Google Job Posting Manager versions = 1.3.1...

WordPress WP Spell Check plugin <= 12.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Spell Check versions = 12.1...

WordPress Simple Event Planner plugin <= 1.5.7 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Simple Event Planner versions = 1.5.7...

WordPress Sunshine Photo Cart plugin <= 3.7.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Sunshine Photo Cart versions = 3.7.1...

WordPress WP Ultimate Exporter plugin <= 3.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Ultimate Exporter versions = 3.0...

WordPress Product Feed PRO for WooCommerce plugin <= 13.5.7 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Product Feed PRO for WooCommerce versions = 13.5.7...

WordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Pay with Vipps for WooCommerce versions = 6.2.0...

WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Peter Tang in WordPress Plugin Advanced Post Manager versions = 4.5.5...

CVE-2026-103442

CVE-2026-103442: CentralAuth MergeAccount object injection Reporter: Marco Paciaroni BomboBombone. CentralAuth accepted a browser-supplied merge-session key when decoding migration state. A user with the centralauth-merge right could substitute a key that produced a PHP object graph. The report's...

CVE-2026-103441

CVE-2026-103441: Wikibase serialized entity object injection Reporter: Marco Paciaroni BomboBombone. The public action=parse API accepted PHP-serialized Wikibase entities. Unrestricted object construction could reach a Smarty destructor that unlinks a caller-selected path. Available PHP gadget...

HTTP-Request-for-PHP-object-injection-attack-on-CVE-2023-41892

Este tipo de ataque intenta explotar el proceso de deserialización de la aplicación PHP para ejecutar código arbitrario o llevar a cabo acciones no deseadas en el servidor. Estrategias de Mitigación Para defenderse contra la inyección de objetos PHP y ataques similares, considere las siguientes...

CVE-2024-52430

CVE-2024-52430 Lis Video Gallery = 0.2.1 - Inyección de Objetos PHP no Autenticada Descripción El plugin Lis Video Gallery para WordPress es vulnerable a la Inyección de Objetos PHP en versiones hasta la 0.2.1 inclusive, a través de la deserialización de entrada no confiable. Esto permite que...

CVE-2024-50507

CVE-2024-50507 DS.DownloadList = 1.3 - Inyección de Objetos PHP sin Autenticación Descripción El plugin DS.DownloadList para WordPress es vulnerable a la Inyección de Objetos PHP en todas las versiones hasta la 1.3 inclusive, a través de la deserialización de entrada no confiable. Esto permite qu...

CVE-2024-56058

CVE-2024-56058 VRPConnector = 2.0.1 - Inyección de Objetos PHP sin Autenticación Descripción El plugin VRPConnector para WordPress es vulnerable a la Inyección de Objetos PHP en versiones hasta la 2.0.1 inclusive mediante la deserialización de entrada no confiable. Esto permite que atacantes no...

CVE-2026-65883

CVE-2026-65883 — Aimy Captcha-Less Form Guard = 20.0 clfgd Field → XOR Recovery → unserialize → FormattedtextLogger → RCE Overview Unauthenticated PHP Object Injection in Aimy Captcha-Less Form Guard for Joomla. The onCheckAnswer method base64-decodes the attacker-controlled clfgd POST field, run...

CVE-2026-78006-POC

CVE-2026-78006-POC POC for CVE-2026-78006 The Events Calendar = 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution CONTACT telegram for any ask : @soldout0O 💙 Support the Project If you appreciate my work, consider supporting the project via USDT TRC20:...

CVE-2026-7654

CVE-2026-7654 CVE-2026-7654 Admin Columns PHP Object Injection RCE Exploit...