CVE-2026-62105

CVE-2026-62105 affects the ThemeREX Addons WordPress plugin in versions prior to 2.45.0 , introducing an unauthenticated PHP Object Injection vulnerability. The flaw is exploitable over the network with low complexity, requires no privileges or user interaction, and is scored CVSS 3.1: 9.8 (Criti...

WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability

WordPress Masteriyo - LMS plugin = 3.4.0 - PHP Object Injection vulnerability discovered by 20kilograma in WordPress Plugin Masteriyo - LMS versions = 3.4.0...

WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by nh4tvd in WordPress Plugin ThemeREX Addons versions 2.45.0...

WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by LueRader in WordPress Plugin Everest Forms versions = 3.6.0...

WordPress Site Reviews plugin 7.2.2-8.2.2 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Jakub Herman in WordPress Plugin Site Reviews versions 7.2.2-8.2.2...

WordPress Weaver Show Posts plugin < 1.8.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Do Xuan Trung in WordPress Plugin Weaver Show Posts versions 1.8.1...

Exploit for CVE-2026-82222

CVE-2026-82222 — GiveWP Unauthenticated PHP Object Injection →...

CVE-2026-62103: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...

PT-2026-90020

Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...

PT-2026-90598

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.8 Description The Tutor LMS plugin for WordPress is affected by a PHP Object Injection issue that can lead to remote code execution on over 100,000 sites worldwide. The flaw exists in the tutor save withdraw...

PT-2026-90023

Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...

PT-2026-90021

Unauthenticated PHP Object Injection in ThemeREX Addons 2.45.0 versions...

CVE-2026-62107: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...

CVE-2026-62105: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in ThemeREX Addons 2.45.0 versions...

Fedora 44 : dokuwiki (2026-9bbb604ea2)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-9bbb604ea2 advisory. Backport object injection RCE fix - see https://github.com/dokuwiki/dokuwiki/issues/4752 Tenable has extracted the preceding description block directly from...

Fedora 43 : dokuwiki (2026-046b69d591)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-046b69d591 advisory. Backport object injection RCE fix - see https://github.com/dokuwiki/dokuwiki/issues/4752 Tenable has extracted the preceding description block directly from...

CVE-2026-73699

FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize in the Perms::getPerms method, where a positional array is used instead of the required named-key array to...

CVE-2026-73699

FileRun before 2026.3.0 is affected by a PHP object injection vulnerability in the Perms::getPerms() method. The root cause is an incorrect option passed to unserialize() : a positional array is used instead of the required named-key array, failing to disable class instantiation. Authenticated at...

EUVD-2026-75601

FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize in the Perms::getPerms method, where a positional array is used instead of the required named-key array to...

CVE-2026-73699 FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms()

FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize in the Perms::getPerms method, where a positional array is used instead of the required named-key array to...