CVE-2024-1773 PDF Invoices and Packing Slips For WooCommerce <= 1.3.7 - Authenticated (Subscriber+) PHP Object Injection

The PDF Invoices and Packing Slips For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.7 via deserialization of untrusted input via the orderid parameter. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2024-1773 PDF Invoices and Packing Slips For WooCommerce <= 1.3.7 - Authenticated (Subscriber+) PHP Object Injection

The PDF Invoices and Packing Slips For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.7 via deserialization of untrusted input via the orderid parameter. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2024-1773

CVE-2024-1773 concerns the PDF Invoices and Packing Slips For WooCommerce WordPress plugin, where PHP Object Injection can occur in all versions up to and including 1.3.7 via deserialization of untrusted input through the order_id parameter. The vulnerability authorizes authenticated attackers wi...

WordPress plugin PDF Invoices and Packing Slips For WooCommerce Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL server set up a personal blog site. WordPress plugin is an application plug-in. WordPress plugin PDF Invoices and...

PT-2024-18294 · WordPress · Woocommerce Pdf Invoices & Packing Slips

Name of the Vulnerable Software and Affected Versions: PDF Invoices and Packing Slips For WooCommerce plugin for WordPress versions up to, and including, 1.3.7 Description: The issue allows authenticated attackers with subscriber-level access and above to inject a PHP Object via deserialization o...

BIT-WORDPRESS-2020-36326

PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in...

BIT-WORDPRESS-MULTISITE-2020-36326

PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in...

BIT-SUITECRM-2020-8800

SuiteCRM through 7.11.11 allows EmailsControllerActionGetFromFields PHP Object Injection...

BIT-WORDPRESS-2022-21663 Authenticated Object Injection in Multisites in WordPress

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in WordPress version 5.8.3...

BIT-WORDPRESS-MULTISITE-2022-21663 Authenticated Object Injection in Multisites in WordPress

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in WordPress version 5.8.3...

BIT-PHPMAILER-2020-36326

PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in...

WordPress Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid Plugin <= 1.3.8 is vulnerable to PHP Object Injection

Software Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid Type Plugin Vulnerable versions = 1.3.8 Fixed in 1.3.9 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-1951 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 5b1fd4bab381...

PDF Invoices and Packing Slips For WooCommerce < 1.3.8 - Authenticated (Subscriber+) PHP Object Injection

Description The PDF Invoices and Packing Slips For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.7 via deserialization of untrusted input via the orderid parameter. This makes it possible for authenticated attackers, with...

WordPress Product Carousel Slider & Grid Ultimate for WooCommerce Plugin <= 1.9.7 is vulnerable to PHP Object Injection

Software Product Carousel Slider & Grid Ultimate for WooCommerce Type Plugin Vulnerable versions = 1.9.7 Fixed in 1.9.8 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-1950 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 0d91488a9b71 Credits...

CVE-2024-1731

The Auto Refresh Single Page plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1 via deserialization of untrusted input from the arspoptions post meta option. This makes it possible for authenticated attackers, with contributor-level access and...

CVE-2024-1731

The Auto Refresh Single Page plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1 via deserialization of untrusted input from the arspoptions post meta option. This makes it possible for authenticated attackers, with contributor-level access and...

CVE-2024-0825

The Vimeography: Vimeo Video Gallery WordPress Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.2 via deserialization of untrusted input via the vimeographyduplicategalleryserialized in the duplicategallery function. This makes it possibl...

CVE-2024-0825

The Vimeography: Vimeo Video Gallery WordPress Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.2 via deserialization of untrusted input via the vimeographyduplicategalleryserialized in the duplicategallery function. This makes it possibl...

Deserialization of untrusted data

The Auto Refresh Single Page plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1 via deserialization of untrusted input from the arspoptions post meta option. This makes it possible for authenticated attackers, with contributor-level access and...

Deserialization of untrusted data

The Vimeography: Vimeo Video Gallery WordPress Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.2 via deserialization of untrusted input via the vimeographyduplicategalleryserialized in the duplicategallery function. This makes it possibl...