CVE-2025-32432

CraftCMS CVE-2025-32432 Chirag Artani द्वारा शोषण अवलोकन यह रिपॉजिटरी CVE-2025-32432 के लिए एक प्रूफ-ऑफ-कॉन्सेप्ट एक्सप्लॉइट स्क्रिप्ट है, जो CraftCMS के संस्करण 4.x और 5.x को प्रभावित करने वाली एक प्री-ऑथेंटिकेशन रिमोट कोड एक्सेक्यूशन RCE कमजोरी है। यह कमजोरी CraftCMS की एसेट ट्रांसफॉर्म जनरेशन...

CVE-2019-6340

CVE-2019-6340 केवल शैक्षिक उद्देश्यों के लिए चलाएँ root@kitploit: $ docker run --rm -p 8080:80 knqyf263/cve-2019-6340 शोषण GET root@kitploit: $ curl -XGET -H "Content-Type: application/hal+json" "http://localhost:8080/node/1?format=haljson" -d ' "link": "value": "link", "options":...

HTTP-Request-for-PHP-object-injection-attack-on-CVE-2023-41892

Diese Art von Angriff versucht, den Deserialisierungsprozess der PHP-Anwendung auszunutzen, um beliebigen Code auszuführen oder unbeabsichtigte Aktionen auf dem Server durchzuführen. Abwehrstrategien Um sich vor PHP-Object-Injection und ähnlichen Angriffen zu schützen, sollten Sie die folgenden...

CVE-2024-52430

CVE-2024-52430 Lis Video Gallery = 0.2.1 - Nicht authentifizierte PHP-Objekt-Injektion Beschreibung Das Lis Video Gallery Plugin für WordPress ist anfällig für PHP-Objekt-Injektion in Versionen bis einschließlich 0.2.1 über die Deserialisierung von nicht vertrauenswürdigen Eingaben. Dies ermöglic...

CVE-2024-50507

CVE-2024-50507 DS.DownloadList = 1.3 - Iniezione di Oggetti PHP Non Autenticata Descrizione Il plugin DS.DownloadList per WordPress è vulnerabile all'Iniezione di Oggetti PHP in tutte le versioni fino alla 1.3 inclusa tramite deserializzazione di input non attendibili. Ciò rende possibile per...

CVE-2024-56058

CVE-2024-56058 VRPConnector = 2.0.1 - Injeção de Objeto PHP Não Autenticada Descrição O plugin VRPConnector para WordPress é vulnerável a Injeção de Objeto PHP nas versões até, e incluindo, 2.0.1 através da desserialização de entrada não confiável. Isso possibilita que atacantes não autenticados...

My Geo Posts Free <= 1.2 - PHP Object Injection

The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If ...

GiveWP - PHP Object Injection

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'givetitle' parameter. id: CVE-2024-5932 info: name: GiveWP - PHP Object Injection author:...

GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1. This is due to insufficient input validation on user-supplied data. An unauthenticated attacker can inject a serialized PHP object, which...

Better Search Replace < 1.4.5 - PHP Object Injection

The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. I...

CVE-2024-8353

Questo post è un articolo di ricerca pubblicato da EQSTLab. Grazie acuokon, che ha scoperto questa vulnerabilità. Introduzione Ulteriore analisi di CVE-2024-5932 EQST Insight R&Tfile PDF. https://github.com/user-attachments/assets/085c2f81-2894-4bb7-a3f5-62406dcb1021 CVE-2024-8353 ★ CVE-2024-8353...

CVE-2026-76547

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by defaul...

CVE-2026-76547

CVE-2026-76547 affects the User Profile Builder WordPress plugin before version 4.0.1 . The root cause is unvalidated deserialization when importing a configuration file, enabling PHP Object Injection by high-privilege users (e.g., administrators). Two significant mitigating factors reduce practi...

EUVD-2026-68051

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by defaul...

CVE-2026-76547 Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by defaul...

CVE-2022-24087

CVE-2022-24087-RCE und CVE-2022-24086-RCE CVE-Beschreibung CVE-2022-24086 und CVE-2022-24087 - eine Schwachstelle durch unzureichende Eingabevalidierung im Kontaktformular von Magento Open Source und Adobe Commerce - haben einen CVSS-Score von 9,8 von 10 erhalten und werden als...

CVE-2026-46275

CVE-2026-46725 — Estensione TYPO3 ceselector RCE Iniezione di oggetti PHP tramiteunserialize bypass di cookie → Esecuzione di codice remoto 📋 Indice Informazioni sulla vulnerabilità Dettagli tecnici Requisiti Installazione Utilizzo Esempi Formato dell'output Come funziona...

GHSA-W23P-WRP7-CH38 Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)

Summary Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource deserializes the hotspots object-store column through the Pimcore\Tool\Serialize::unserialize wrapper without a class allowlist the wrapper's $allowedClasses parameter defaults to true, i.e. fully unrestricted...

EUVD-2026-67870

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource in models/DataObject/ClassDefinition/Data/Hotspotimage.php passes the field hotspots object-store column to...

CVE-2025-7384

CVE-2025-7384 — Iniezione di Oggetti PHP verso RCE Plugin: Database for Contact Form 7 contact-form-entries ≤ 1.4.3 CVSS: 9.8 Critico CWE: CWE-502 — Deserializzazione di dati non attendibili Requisito di autenticazione: Nessuno non autenticato Impatto: Esecuzione di codice in remoto Sommario 1...