CVE-2026-24891 openITCOCKPIT has Unsafe PHP Deserialization in Gearman Worker Allowing Conditional Object Injection

openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus. Versions 5.3.1 and below contain an unsafe deserialization sink in the Gearman worker implementation. The worker function registered as oitcgearman calls PHP's unserialize on...

CVE-2026-23549 WordPress WpEvently plugin <= 5.1.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through = 5.1.1...

CVE-2025-58619 WordPress Falang multilanguage Plugin <= 1.3.65 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in sbouey Falang multilanguage falang allows Object Injection.This issue affects Falang multilanguage: from n/a through = 1.3.65...

CVE-2025-53586

CVE-2025-53586 describes a deserialization of untrusted data vulnerability in the WordPress WordPress theme Noi? NooTheme WeMusic (noo-wemusic) affecting versions from n/a through ≤ 1.9.1. The underlying issue is PHP object injection due to deserializing untrusted data in the WeMusic plugin/theme...

PT-2025-44222

Name of the Vulnerable Software and Affected Versions Contact Form CFDB7 versions up to and including 1.3.2 Description The Contact Form CFDB7 plugin for WordPress is affected by a pre-authentication SQL injection that can lead to insecure deserialization PHP Object Injection. Insufficient...

CVE-2025-60226 WordPress White Rabbit theme <= 1.5.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes White Rabbit whiterabbit allows Object Injection.This issue affects White Rabbit: from n/a through = 1.5.2...

EUVD-2004-1017

Malware in sbrugna...

EUVD-2019-4447

Malware in sbrugna...

EUVD-2024-52307

Malicious code in bioql PyPI...

EUVD-2024-52306

Malicious code in bioql PyPI...

CVE-2025-53572 WordPress WP Easy Contact Plugin <= 4.0.1 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in emarket-design WP Easy Contact wp-easy-contact allows Object Injection.This issue affects WP Easy Contact: from n/a through = 4.0.1...

Linux Distros Unpatched Vulnerability : CVE-2021-29476

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of Requests 1.6.0, 1.6....

Exploit for CVE-2025-49113

CVE-2025-49113 Roundcube Exploit A Python exploit for CVE-202...

CVE-2025-24779 WordPress Yogi theme < 2.9.3 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in NooTheme Yogi yogi allows Object Injection.This issue affects Yogi: from n/a through 2.9.3...

CVE-2025-53990 WordPress JetFormBuilder plugin <= 3.5.1.2 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in jetmonsters JetFormBuilder allows Object Injection. This issue affects JetFormBuilder: from n/a through 3.5.1.2...

CVE-2025-25034 SugarCRM PHP Deserialization RCE

A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the restdata parameter before passing it to the...

CVE-2025-25034 SugarCRM PHP Deserialization RCE

A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the restdata parameter before passing it to the...

SUSE CVE-2025-49113

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization...

PT-2025-23470 · Roundcube · Roundcube

Name of the Vulnerable Software and Affected Versions: Roundcube versions prior to 1.6.11 Description: The issue is related to a Post-Auth RCE via PHP Object Deserialization in Roundcube. It is estimated that over 53 million hosts are potentially affected. The bug has existed undetected for 10...

CVE-2024-24725

Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/importrun.php=externalAssessment=4 URI...