CVE-2017-18583

The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection...

CVE-2017-18583

CVE-2017-18583 affects the WordPress plugin post-pay-counter (before 2.731) with a PHP Object Injection flaw. The advisory sources identify this as a high/critical issue: CVSS v2 base score 7.5 (HIGH) and CVSS v3.0 base score 9.8 (CRITICAL) with network attack vector, no user interaction, and imp...

CVE-2017-18583

The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection...

PT-2019-8517

Name of the Vulnerable Software and Affected Versions post-pay-counter plugin for WordPress versions prior to 2.731 Description The issue is related to PHP Object Injection in the post-pay-counter plugin for WordPress. Recommendations For versions prior to 2.731, update the post-pay-counter plugi...

CVE-2017-18583: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection...

PT-2019-10424

Name of the Vulnerable Software and Affected Versions newsletters-lite plugin versions prior to 4.6.8.6 Description The issue concerns PHP object injection in the newsletters-lite plugin for WordPress. Recommendations For versions prior to 4.6.8.6, update to version 4.6.8.6 or later to resolve th...

CVE-2018-20987: Deserialization of Untrusted Data

The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection...

Breaking Into Your Company's Internal Network - SuiteCRM 7.11.4

As part of our efforts to make the open source web application space more secure we scanned SuiteCRM 7.11.4 with our static code analysis tool RIPS and we detected multiple critical vulnerabilities. Among them is a SQL Injection that can be exploited as a normal user CVE-2019-12598, which can be...

Agent Tesla Panel Remote Code Execution

This module exploits a command injection vulnerability within the Agent Tesla control panel, in combination with an SQL injection vulnerability and a PHP object injection vulnerability, to gain remote code execution on affected hosts. Panel versions released prior to Sepetember 12, 2018 can be...

Exploit for Deserialization of Untrusted Data in Pydio

CVE-2018-20718 This is a POC for CVE-2018-20718. It is a PHP O...

e107 < 2.1.3 SQL Injection Vulnerability

e107 is prone to an SQL injection vulnerability through object injection. Copyright C 2019 Greenbone Networks GmbH, https://www.greenbone.net SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public...

Sql injection

e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC...

CVE-2016-10753

e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC...

CVE-2016-10753

e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC...

CVE-2016-10753

e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC...

CVE-2016-10753

CVE-2016-10753 affects e107 2.1.2. It enables a PHP Object Injection vulnerability via usersettings.php that calls unserialize without an HMAC, which leads to a subsequent SQL injection. The root cause is improper handling of unserialize data, enabling an attacker-controlled object to affect data...

PT-2019-7549

Name of the Vulnerable Software and Affected Versions e107 version 2.1.2 Description The issue allows PHP Object Injection, which can result in SQL injection. This is because the usersettings.php file uses the unserialize function without an HMAC. Recommendations For e107 version 2.1.2, consider...

CVE-2016-10753: Deserialization of Untrusted Data

e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC...

CVE-2019-5434

An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize call on the "what" parameter in the "openads.spc" RPC method. Such vulnerability could be used to perform various types of attacks, e.g. exploit serialize-related PHP vulnerabilities...

CVE-2019-5434

An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize call on the "what" parameter in the "openads.spc" RPC method. Such vulnerability could be used to perform various types of attacks, e.g. exploit serialize-related PHP vulnerabilities...