36144 matches found
DRUPAL-CORE-2026-005
SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web services. The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially inject a malicious payload in certain...
DRUPAL-CONTRIB-2026-050
The Plotly.js Graphing module provides a fully customizable implementation of the open source Plotly.js graphing library. The module stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can lead to an object injection...
DRUPAL-CONTRIB-2026-049
The Flag attendance field module gives you the ability to add attendance by depending on Flag module. flagattendancefield stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can lead to an object injection vulnerability when th...
DRUPAL-CONTRIB-2026-048
The Formatter Field module provides a mechanism for specifying a formatter and formatter settings to be used for displaying a field, on a per-entity basis. formatterfield stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can...
EUVD-2025-210259
Subscriber PHP Object Injection in Entrepreneur - Booking for Small Businesses WordPress Theme = 3.1.3 versions...
EUVD-2025-210249
Unauthenticated Insecure Direct Object References IDOR in School Management = 93.1.0 versions...
EUVD-2025-210258
Unauthenticated PHP Object Injection in Plumbing = 1.6 versions...
EUVD-2025-210253
Unauthenticated PHP Object Injection in Reisen = 1.4.1 versions...
EUVD-2026-37629
Unauthenticated Insecure Direct Object References IDOR in Clean Login = 1.15 versions...
EUVD-2026-37628
Unauthenticated PHP Object Injection in JetEngine = 3.8.10 versions...
EUVD-2026-37642
Unauthenticated PHP Object Injection in WP Activity Log = 5.6.3.1 versions...
EUVD-2026-37617
Contributor PHP Object Injection in JetEngine = 3.8.9.1 versions...
EUVD-2026-37622
Unauthenticated PHP Object Injection in Thrive Apprentice 10.8.10.2 versions...
EUVD-2026-37594
Unauthenticated PHP Object Injection in WooCommerce Product Filters 2.0.6 versions...
EUVD-2026-37604
Unauthenticated Insecure Direct Object References IDOR in Salon booking system = 10.30.24 versions...
EUVD-2026-37597
Unauthenticated PHP Object Injection in Reina = 2.1 versions...
EUVD-2026-37607
Unauthenticated PHP Object Injection in AI Lab 5.4.2 versions...
EUVD-2026-37602
Unauthenticated PHP Object Injection in EasyMeals = 1.5.1 versions...