CVE-2026-3296

CVE-2026-3296 CVE-2026-3296 is a CVSS 9.8 Critical unauthenticated PHP Object Injection vulnerability in the Everest Forms WordPress plugin CVE-2026-3296 — Everest Forms PHP Object Injection Scanner Plugin: Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder Plugin Slug...

CVE-2023-27372-SPIP-4.2.1-Unauthenticated-RCE-PoC

CVE-2023-27372 — SPIP Unauthenticated remote code execution vulnerability in SPIP before 4.2.1. The oubli parameter in the password reset form is vulnerable to PHP object injection due to mishandled deserialization. A crafted serialized payload is executed server-side as the web user, and the...

GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1. This is due to insufficient input validation on user-supplied data. An unauthenticated attacker can inject a serialized PHP object, which...

My Geo Posts Free <= 1.2 - PHP Object Injection

The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If ...

LearnPress <= 4.4.9.1 - PHP Object Injection

LearnPress WordPress plugin = 4.4.10 contains a PHP Object Injection caused by deserialization of untrusted 'checkout-email' parameter in checkout AJAX action, letting unauthenticated attackers inject PHP objects remotely. id: CVE-2026-104736 info: name: LearnPress = 4.4.9.1 - PHP Object Injectio...

CVE-2019-6340

CVE-2019-6340 For educational purposes only Run $ docker run --rm -p 8080:80 knqyf263/cve-2019-6340 Exploit GET $ curl -XGET -H "Content-Type: application/hal+json" "http://localhost:8080/node/1?format=haljson" -d ' "link": "value": "link", "options":...

CVE-2024-12877-Exploit

GO-TO CVE – CVE-2024-12877-Exploit Week 66 | Author: Ali Soltani soltanali0 Welcome to Week 66 of the GO-TO CVE series , where we dissect vulnerabilities, analyze root causes, and demonstrate practical exploitation techniques in a safe, educational context. 🚨 Overview CVE-2024-12877 is a PHP Obje...

CVE-2025-43960

CVE-2025-43960 - PHP Object Injection in Adminer 4.8.1 via Monolog - Denial of Service DoS After months of waiting for a response from MITRE, I obtained CVE-2025-43960 with a PHP Object Injection attack against the Adminer service 4.8.1, causing a Denial of Service DoS through Memory Manipulation...

vulnerable-bsr-lab-CVE-2023-6933

CVE-2023-6933 Vulnerability Lab Overview This laboratory environment demonstrates CVE-2023-6933, a critical PHP Object Injection vulnerability in the Better Search Replace WordPress plugin versions ≤1.4.4. Vulnerability Details CVE ID : CVE-2023-6933 CVSS Score : 9.8 Critical Affected Plugin :...

CVE-2024-1813-POC

CVE-2024-1813 - Simple Job Board ≤ 2.11.0 WordPress - Unauthenticated PHP Object Injection 🎥 Proof-of-Concept demo End-to-end: a guest stores a serialized PHP object through the public application form, the admin opens the applicants list, and the gadget chain drops a webshell. Unauthenticated PH...

CVE-2026-82222

CVE-2026-82222 — GiveWP Author: Rx019 CVSS: 10.0 Critical Type: Unauthenticated PHP Object Injection → Remote Code Execution Plugin: GiveWP give — Donation Plugin and Fundraising Platform Affected: Patched: 4.16.8 Description GiveWP stores a donor's lastname in the PHP session without sanitizatio...

CVE-2026-48909-Joomla-SP-Exploit

CVE-2026-48909 Joomla SP LMS — Unauthenticated PHP Object Injection → RCE Proof-of-concept assessment tool for CVE-2026-48909 Author: Sudeepa Wanigarathna !IMPORTANT Authorized use only. This tool is for security research, education, and testing systems you own or have explicit written permission...

CVE-2024-8353

This post is a research article published by EQSTLab. Thanks tocuokon, who discovered this vulnerability. Introduction Further Analysis CVE-2024-5932 EQST Insight R&TPDF file. https://github.com/user-attachments/assets/085c2f81-2894-4bb7-a3f5-62406dcb1021 CVE-2024-8353 ★ CVE-2024-8353 Arbitrary...

CVE-2024-50507

CVE-2024-50507 DS.DownloadList = 1.3 - Unauthenticated PHP Object Injection Description The DS.DownloadList plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3 via deserialization of untrusted input. This makes it possible for unauthenticated...

cve-2026-82222-poc

CVE-2026-82222 Unauthenticated PHP object injection to RCE in GiveWP & % in the command; spaces become $IFS. Pass a form id if discovery misses. Pass -g if the script cannot find an enabled gateway. The donation request often returns HTTP 500 or times out. That is expected. The session write...

CVE-2026-7654

CVE-2026-7654 CVE-2026-7654 Admin Columns PHP Object Injection RCE Exploit...

CVE-2025-32432

CraftCMS CVE-2025-32432 Exploit By Chirag Artani Overview This repository contains a proof-of-concept exploit script for CVE-2025-32432, a pre-authentication Remote Code Execution RCE vulnerability affecting CraftCMS versions 4.x and 5.x. The vulnerability exists in the asset transform generation...

CVE-2023-46615

CVE-2023-46615 KD Coming Soon = 1.7 - Unauthenticated PHP Object Injection via cetitle Description: The KD Coming Soon plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7 via deserialization of untrusted input cetitle in the vulnerable kdcemailer...

CVE-2018-20718

CVE-2018-20718 This is a POC for CVE-2018-20718. It is a PHP Object injection vulnerability. The vulnerability affect all version of Pydio before 8.2.1 and leads to Unauthenticated Remote Code Execution. It was originaly found by RIPS. I found a gadget in Pydio\Core\Controller\ShutdownScheduler...

CVE-2020-28032_PoC

CVE-2020-28032PoC PoC for CVE-2020-28032 It's just a POP chain in WordPress RequestsUtilityFilteredIterator Object callback:protected = system storage:ArrayIterator:private = Array 0 = id uid=1000nth347 gid=1000nth347...