5543 matches found
CVE-2026-40877 Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences
Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3...
CVE-2026-40877 Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences
Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3...
CVE-2026-40877
Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3...
WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by 20kilograma in WordPress Plugin WP Project Manager versions = 4.0.6...
WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Udin Chan in WordPress Plugin The Events Calendar versions = 6.17.2...
WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability
WordPress ACPT Pro - Custom Post Types Plugin for WordPress plugin = 2.0.63 - PHP Object Injection vulnerability discovered by VDsec in WordPress Plugin ACPT Pro - Custom Post Types Plugin for WordPress versions = 2.0.63...
CVE-2026-66650
Unauthenticated PHP Object Injection in FreightCo = 1.1.15 versions...
WordPress BookingPress plugin < 1.5.6 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability discovered by Sanjar Tulkinov in WordPress Plugin BookingPress versions 1.5.6...
EUVD-2026-64809
Unauthenticated PHP Object Injection in FreightCo = 1.1.15 versions...
CVE-2026-66650 WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in FreightCo = 1.1.15 versions...
CVE-2026-66650 WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in FreightCo = 1.1.15 versions...
CVE-2026-66650
CVE-2026-66650 is an unauthenticated PHP Object Injection vulnerability in the WordPress theme FreightCo , affecting versions ≤ 1.1.15 . Discovered by daroo , it allows a remote, unauthenticated attacker to achieve full compromise (confidentiality, integrity, and availability), rated CVSS 9.8 (CR...
PT-2026-81052
Name of the Vulnerable Software and Affected Versions ACPT Pro - Custom Post Types Plugin for WordPress versions 2.0.63 and earlier Description PHP Object Injection occurs when an application deserializes untrusted data, allowing an attacker to manipulate the resulting object and potentially...
CVE-2026-78265: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in The Events Calendar = 6.17.2 versions...
CVE-2026-78262: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in WP Project Manager = 4.0.6 versions...
CVE-2026-32563: Deserialization of Untrusted Data
Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
CVE-2026-66650: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in FreightCo = 1.1.15 versions...
PT-2026-81058
Name of the Vulnerable Software and Affected Versions The Events Calendar versions prior to 6.17.3 Description An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the PHP unserialize function, potentially allowing an attacker to...
CVE-2026-40877: Deserialization of Untrusted Data
Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3...