345 matches found
CVE-2021-4451 NinjaFirewall <= 4.3.3 - Authenticated PHAR Deserialization
The NinjaFirewall plugin for WordPress is vulnerable to Authenticated PHAR Deserialization in versions up to, and including, 4.3.3. This allows authenticated attackers to perform phar deserialization on the server. This deserialization can allow other plugin or theme exploits if vulnerable softwa...
CVE-2021-4451
The NinjaFirewall WordPress plugin is affected (versions up to and including 4.3.3) by an authenticated PHAR deserialization issue. The underlying deserialization can enable exploits from other plugins/themes if vulnerable software is present. No specific exploit details or remediation are provid...
WordPress plugin NinjaFirewall 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...
CVE-2022-2439 Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR Deserialization
The Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress is vulnerable to deserialization of untrusted input via the 'uploadfile' parameter in versions up to, and including 3.3.3. This makes it possible for authenticated administrative users to call files using...
CVE-2022-2446 WP Editor <= 1.2.9 - Authenticated (Admin+) PHAR Deserialization
The WP Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'currentthemeroot' parameter in versions up to, and including 1.2.9. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will...
WordPress WP Editor plugin <= 1.2.9 - Authenticated (Admin+) PHAR Deserialization vulnerability
Authenticated Admin+ PHAR Deserialization vulnerability discovered by Rasoul Jahanshahi in WordPress Plugin WP Editor versions = 1.2.9...
CVE-2022-2440 Theme Editor <= 2.8 - Authenticated (Admin+) PHAR Deserialization
The Theme Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'imagesarray' parameter in versions up to, and including 2.8. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserializ...
WordPress Theme Editor plugin <= 2.8 - Authenticated (Admin+) PHAR Deserialization vulnerability
Authenticated Admin+ PHAR Deserialization vulnerability discovered by Rasoul Jahanshahi in WordPress Plugin Theme Editor versions = 2.8...
WordPress GEO my WordPress plugin < 4.5.0.2 - Unauthenticated LFI to RCE/PHAR Deserialization vulnerability
Unauthenticated LFI to RCE/PHAR Deserialization vulnerability discovered by Michael Dyrna in WordPress Plugin GEO my WordPress versions 4.5.0.2...
CVE-2024-33568 WordPress Element Pack Pro plugin < 7.19.3 - Arbitrary File Read and Phar Deserialization vulnerability
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal', Deserialization of Untrusted Data vulnerability in BdThemes Element Pack Pro allows Path Traversal, Object Injection.This issue affects Element Pack Pro: from n/a before 7.19.3...
CVE-2024-33568 WordPress Element Pack Pro plugin < 7.19.3 - Arbitrary File Read and Phar Deserialization vulnerability
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal', Deserialization of Untrusted Data vulnerability in BdThemes Element Pack Pro allows Path Traversal, Object Injection.This issue affects Element Pack Pro: from n/a before 7.19.3...
CVE-2024-24934 WordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerability
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Elementor Elementor Website Builder allows Manipulating Web Input to File System Calls.This issue affects Elementor Website Builder: from n/a through 3.19.0...
CVE-2024-24934 WordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerability
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Elementor Elementor Website Builder allows Manipulating Web Input to File System Calls.This issue affects Elementor Website Builder: from n/a through 3.19.0...
image-optimizer allows PHAR deserialization
image-optimizer before 1.7.3 allows PHAR deserialization, e.g., the phar:// protocol in arguments to fileexists...
CVE-2024-34515
image-optimizer before 1.7.3 allows PHAR deserialization, e.g., the phar:// protocol in arguments to fileexists...
CVE-2024-34515
image-optimizer before 1.7.3 allows PHAR deserialization, e.g., the phar:// protocol in arguments to fileexists...
CVE-2024-34515
CVE-2024-34515 affects the image-optimizer package prior to 1.7.3. The vulnerability stems from PHAR deserialization via the phar:// protocol in arguments to file_exists(), enabling deserialization of untrusted data and, per multiple sources, potential remote code execution. Affected versions are...
image-optimizer 安全漏洞
image-optimizer is an open source package from Spatie. It can run PNG, JPG, WEBP, AVIF, SVG and GIF through a range of various image optimization tools. A security vulnerability exists in versions of image-optimizer prior to 1.7.3 that stems from allowing PHAR deserialization...
