CVE-2016-3154

SPIP contains a PHP object injection vulnerability (CVE-2016-3154) in the encoder_contexte_ajax path (ecrire/inc/filtres.php). The issue affects SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1, where deserializing crafted object data can allow remote attackers to inject object...

CVE-2016-3154: Improper Control of Generation of Code

The encodercontexteajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object...

PT-2016-5386

Name of the Vulnerable Software and Affected Versions SPIP versions 2.x prior to 2.1.19 SPIP versions 3.0.x prior to 3.0.22 SPIP versions 3.1.x prior to 3.1.1 Description The issue allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted...

WordPress Easy Digital Downloads Plugin <= 2.5.7 - PHP Object Injection

Because of this vulnerability, attackers can execute arbitrary PHP code. Solution Upgrade the plugin...

Easy Digital Downloads <= 2.5.7 - PHP Object Injection

Easy Digital Downloads unserializes user-submitted data from cookies and other request parameters, allowing for object injection...

WordPress Ninja Forms Plugin <= 2.9.42.0 - PHP Object Injection

This vulnerability allows an attacker to conduct PHP object injection attacks via crafted serialized values in a POST request. Solution Update the plugin...

CVE-2015-8562

Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015...

CVE-2015-8562

Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015...

CVE-2015-8562

CVE-2015-8562 affects Joomla! 1.5.x, 2.x, and 3.x prior to 3.4.6. The vulnerability enables remote PHP object injection that can lead to arbitrary code execution, originally described as exploitable via the HTTP User-Agent header. Public PoCs and exploits exist (e.g., Exploit-DB entries for CVE-2...

CVE-2015-8562: Improper Input Validation

Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015...

PT-2015-7807

Name of the Vulnerable Software and Affected Versions Joomla! versions 1.5.x through 3.x before 3.4.6 Description The issue allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header. This has been exploited in the wild...

CVE-2015-7808

The vBApiHook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in the arguments parameter to ajax/api/hook/decodeArguments...

Design/Logic Flaw

The vBApiHook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in the arguments parameter to ajax/api/hook/decodeArguments...

CVE-2015-7808

The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect versions 5.1.2 through 5.1.9 is vulnerable to PHP object injection . Remote attackers can execute arbitrary PHP code by sending a crafted serialized object via the arguments parameter to the ajax/api/hook/decodeArguments endpoint. Thi...

CVE-2015-7808

The vBApiHook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in the arguments parameter to ajax/api/hook/decodeArguments...

PT-2015-7621

Name of the Vulnerable Software and Affected Versions vBulletin 5 Connect versions 5.1.2 through 5.1.9 Description The issue allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in the arguments parameter to the...

CVE-2015-7808: Improper Input Validation

The vBApiHook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in the arguments parameter to ajax/api/hook/decodeArguments...

CVE-2015-7816

The DisplayTopKeywords function in plugins/Referrers/Controller.php in Piwik before 2.15.0 allows remote attackers to conduct PHP object injection attacks, conduct Server-Side Request Forgery SSRF attacks, and execute arbitrary PHP code via a crafted HTTP header...

CVE-2015-7816

The DisplayTopKeywords function in plugins/Referrers/Controller.php in Piwik before 2.15.0 allows remote attackers to conduct PHP object injection attacks, conduct Server-Side Request Forgery SSRF attacks, and execute arbitrary PHP code via a crafted HTTP header...

CVE-2015-7816

The DisplayTopKeywords function in plugins/Referrers/Controller.php in Piwik before 2.15.0 allows remote attackers to conduct PHP object injection attacks, conduct Server-Side Request Forgery SSRF attacks, and execute arbitrary PHP code via a crafted HTTP header...