5568 matches found
PT-2019-10424
Name of the Vulnerable Software and Affected Versions newsletters-lite plugin versions prior to 4.6.8.6 Description The issue concerns PHP object injection in the newsletters-lite plugin for WordPress. Recommendations For versions prior to 4.6.8.6, update to version 4.6.8.6 or later to resolve th...
CVE-2018-20987: Deserialization of Untrusted Data
The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection...
CVE-2017-18583: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection...
PT-2019-8517
Name of the Vulnerable Software and Affected Versions post-pay-counter plugin for WordPress versions prior to 2.731 Description The issue is related to PHP Object Injection in the post-pay-counter plugin for WordPress. Recommendations For versions prior to 2.731, update the post-pay-counter plugi...
Breaking Into Your Company's Internal Network - SuiteCRM 7.11.4
As part of our efforts to make the open source web application space more secure we scanned SuiteCRM 7.11.4 with our static code analysis tool RIPS and we detected multiple critical vulnerabilities. Among them is a SQL Injection that can be exploited as a normal user CVE-2019-12598, which can be...
Agent Tesla Panel Remote Code Execution
This module exploits a command injection vulnerability within the Agent Tesla control panel, in combination with an SQL injection vulnerability and a PHP object injection vulnerability, to gain remote code execution on affected hosts. Panel versions released prior to Sepetember 12, 2018 can be...
Exploit for Deserialization of Untrusted Data in Pydio
CVE-2018-20718 This is a POC for CVE-2018-20718. It is a PHP O...
e107 < 2.1.3 SQL Injection Vulnerability
e107 is prone to an SQL injection vulnerability through object injection. Copyright C 2019 Greenbone Networks GmbH, https://www.greenbone.net SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public...
Sql injection
e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC...
CVE-2016-10753
e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC...
CVE-2016-10753
e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC...
CVE-2016-10753
e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC...
CVE-2016-10753
CVE-2016-10753 affects e107 2.1.2. It enables a PHP Object Injection vulnerability via usersettings.php that calls unserialize without an HMAC, which leads to a subsequent SQL injection. The root cause is improper handling of unserialize data, enabling an attacker-controlled object to affect data...
PT-2019-7549
Name of the Vulnerable Software and Affected Versions e107 version 2.1.2 Description The issue allows PHP Object Injection, which can result in SQL injection. This is because the usersettings.php file uses the unserialize function without an HMAC. Recommendations For e107 version 2.1.2, consider...
CVE-2016-10753: Deserialization of Untrusted Data
e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC...
CVE-2019-5434
An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize call on the "what" parameter in the "openads.spc" RPC method. Such vulnerability could be used to perform various types of attacks, e.g. exploit serialize-related PHP vulnerabilities...
CVE-2019-5434
An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize call on the "what" parameter in the "openads.spc" RPC method. Such vulnerability could be used to perform various types of attacks, e.g. exploit serialize-related PHP vulnerabilities...
PT-2019-17666
Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 4.2.0 Description The issue allows an attacker to send a specifically crafted payload to the XML-RPC invocation script, triggering the unserialize call on the what parameter in the openads.spc RPC method. This...
CVE-2019-5434: Deserialization of Untrusted Data
An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize call on the "what" parameter in the "openads.spc" RPC method. Such vulnerability could be used to perform various types of attacks, e.g. exploit serialize-related PHP vulnerabilities...
