PT-2017-8752

Name of the Vulnerable Software and Affected Versions Simple Machines Forum SMF version 2.1 Description The issue allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the themechanges array parameter. Recommendations For Simple Machines Forum SMF...

CVE-2017-5677

PEAR HTMLAJAX 0.3.0 through 0.5.7 has a PHP Object Injection Vulnerability in the PHP Serializer. It allows remote code execution. In one viewpoint, the root cause is an incorrect regular expression...

CVE-2017-5677

PEAR HTMLAJAX 0.3.0 through 0.5.7 has a PHP Object Injection Vulnerability in the PHP Serializer. It allows remote code execution. In one viewpoint, the root cause is an incorrect regular expression...

CVE-2017-5677: Undefined Security Weakness

PEAR HTMLAJAX 0.3.0 through 0.5.7 has a PHP Object Injection Vulnerability in the PHP Serializer. It allows remote code execution. In one viewpoint, the root cause is an incorrect regular expression...

PT-2017-16666

Name of the Vulnerable Software and Affected Versions PEAR HTML AJAX versions 0.3.0 through 0.5.7 Description The issue is related to a PHP Object Injection Vulnerability in the PHP Serializer, which allows remote code execution. The root cause is attributed to an incorrect regular expression...

ExpressionEngine: Type Juggling -> PHP Object Injection -> SQL Injection Chain

Justin Kennedy identified a Type Juggling vulnerability in ExpressionEngine that allowed access to unserialize using user supplied data, ultimately achieving SQL Injection. The full details of this vulnerability can be found here:...

WordPress InfiniteWP Client 1.5.1.3 / 1.6.0 PHP Object Injection Vulnerability

Exploit for php platform in category web applications ------------------------------------------------------------------------ InfiniteWP Client WordPress Plugin unauthenticated PHP Object injection vulnerability ------------------------------------------------------------------------ Yorick...

WordPress CMS Commander Client Plugin unauthenticated PHP Object injection vulnerability

Exploit for php platform in category web applications Abstract A PHP Object injection vulnerability was found in the CMS Commander Client WordPress Plugin, which can be used by an unauthenticated user to instantiate arbitrary PHP Objects. Using this vulnerability it is possible to execute arbitra...

CMS Commander Client <= 2.21 - Unauthenticated PHP Object Injection

The CMS Commander – Manage Multiple Sites WordPress plugin was affected by an Unauthenticated PHP Object Injection security vulnerability...

Subrion CMS PHP Object Injection Vulnerability

Subrion CMS is an open source content management system CMS. Subrion CMS suffers from a PHP object injection vulnerability that stems from a failure to adequately validate user input. An attacker can use this vulnerability to inject arbitrary objects into the application, delete files, view files...

CVE-2016-4010

Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data...

CVE-2016-4010: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data...

PT-2017-8442

Name of the Vulnerable Software and Affected Versions Magento CE and EE versions prior to 2.0.6 Description The issue allows remote attackers to conduct PHP object injection attacks, enabling them to execute arbitrary PHP code. This is achieved by sending crafted serialized shopping cart data...

Design/Logic Flaw

includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request...

CVE-2017-5543

includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request...

CVE-2017-5543

includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request...

CVE-2017-5543

includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request...

CVE-2017-5543

CVE-2017-5543 affects Subrion CMS 4.0.5 where a vulnerable PHP file, includes/classes/ia.core.users.php, allows remote attackers to perform PHP Object Injection via crafted serialized data in a salt cookie during login. Public references and CVSS indicate a high-severity impact (NVD lists base sc...

CVE-2017-5543: Improper Control of Generation of Code

includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request...

PT-2017-16570

Name of the Vulnerable Software and Affected Versions Subrion CMS version 4.0.5 Description The issue allows remote attackers to conduct PHP Object Injection attacks. This is achieved by sending crafted serialized data in a salt cookie within a login request to the...