CVE-2024-52415

CVE-2024-52415 describes a CSRF to PHP Object Injection vulnerability in the WordPress plugin SK WP Settings Backup, affecting versions n/a through 1.0. The connected sources indicate the issue exists but do not provide a confirmed patch or remediation in the supplied materials. In practice, this...

PT-2024-35250 · Unknown · Phoenixheart Referrer Detector

Name of the Vulnerable Software and Affected Versions: Phoenixheart Referrer Detector versions n/a through 4.2.1.0 Description: A Deserialization of Untrusted Data vulnerability exists in the Phoenixheart Referrer Detector, allowing Object Injection. This issue affects the handling of untrusted...

PT-2024-35255 · Skpstorm · Skpstorm Sk Wp Settings Backup

Name of the Vulnerable Software and Affected Versions: Skpstorm SK WP Settings Backup versions n/a through 1.0 Description: A Cross-Site Request Forgery CSRF vulnerability in Skpstorm SK WP Settings Backup allows Object Injection. This issue enables an attacker to inject objects, potentially...

PT-2024-35251 · Unknown · Flowcraft Ux Design Studio

Name of the Vulnerable Software and Affected Versions: Flowcraft UX Design Studio Advanced Personalization versions from n/a through 1.1.2 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This problem affects the Advanced Personalization...

PT-2024-35254 · Anthony Carbon · Wdes Responsive Mobile Menu

Name of the Vulnerable Software and Affected Versions: WDES Responsive Mobile Menu versions through 5.3.18 Description: The issue is related to Deserialization of Untrusted Data, allowing Object Injection in Anthony Carbon WDES Responsive Mobile Menu. Recommendations: For versions through 5.3.18,...

PT-2024-35252 · Unknown · Stephen Cui Xin

Name of the Vulnerable Software and Affected Versions: Stephen Cui Xin versions n/a through 1.0.8.1 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This is a weakness in the software that can be exploited. Recommendations: For versions n/a...

PT-2024-35248 · Unknown · Phan An Ajax Random Posts

Name of the Vulnerable Software and Affected Versions: Phan An AJAX Random Posts versions 0.3.3 and earlier Description: The issue is related to Deserialization of Untrusted Data, allowing Object Injection in Phan An AJAX Random Posts. Recommendations: For versions 0.3.3 and earlier, update to a...

PT-2024-35253 · Unknown · Dmc Airin Blog

Name of the Vulnerable Software and Affected Versions: DMC Airin Blog versions 1.6.1 and earlier Description: The issue is related to the deserialization of untrusted data, which allows object injection in DMC Airin Blog. Recommendations: For versions 1.6.1 and earlier, update to a version later...

WordPress My Geo Posts Free plugin <= 1.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin My Geo Posts Free versions = 1.2...

WordPress NIX Anti-Spam Light plugin <= 0.0.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin NIX Anti-Spam Light versions = 0.0.4...

WordPress Lis Video Gallery plugin <= 0.2.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Lis Video Gallery versions = 0.2.1...

WordPress My Geo Posts Free Plugin <= 1.2 is vulnerable to PHP Object Injection

Software My Geo Posts Free Type Plugin Vulnerable versions = 1.2 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-52433 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID abf48ca2de6d Credits Mika Required privilege Unauthenticated...

WordPress Lis Video Gallery Plugin <= 0.2.1 is vulnerable to PHP Object Injection

Software Lis Video Gallery Type Plugin Vulnerable versions = 0.2.1 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-52430 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID a078bb126c5a Credits LVT-tholv2k Required privilege...

WordPress NIX Anti-Spam Light Plugin <= 0.0.4 is vulnerable to PHP Object Injection

Software NIX Anti-Spam Light Type Plugin Vulnerable versions = 0.0.4 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-52432 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID ce1317202bf3 Credits LVT-tholv2k Required privilege...

CVE-2024-10962

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.9.107 via deserialization of untrusted input in the 'replacerowdata' and 'replaceserializedata' functions. This makes it possible for unauthenticated attacke...

CVE-2024-10962

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.9.107 via deserialization of untrusted input in the 'replacerowdata' and 'replaceserializedata' functions. This makes it possible for unauthenticated attacke...

CVE-2024-10962 Migration, Backup, Staging – WPvivid <= 0.9.107 - Unauthenticated PHP Object Injection

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.9.107 via deserialization of untrusted input in the 'replacerowdata' and 'replaceserializedata' functions. This makes it possible for unauthenticated attacke...

CVE-2024-10962

The CVE-2024-10962 entry concerns the WPvivid (Migration, Backup, Staging) WordPress plugin, affected in versions up to and including 0.9.107. It describes an unauthenticated PHP Object Injection vulnerability caused by deserialization of untrusted input in the replace_row_data and replace_serial...

CVE-2024-10962 Migration, Backup, Staging – WPvivid <= 0.9.107 - Unauthenticated PHP Object Injection

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.9.107 via deserialization of untrusted input in the 'replacerowdata' and 'replaceserializedata' functions. This makes it possible for unauthenticated attacke...

WordPress Migration, Backup, Staging – WPvivid plugin <= 0.9.107 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Webbernaut in WordPress Plugin WPvivid Backup and Migration versions = 0.9.107...