5479 matches found
CVE-2026-12115 Counter Box <= 2.0.13 - Authenticated (Administrator+) PHP Object Injection via Import
The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level...
PT-2026-50409
Unauthenticated PHP Object Injection in Moderno 1.43 versions...
CVE-2025-69122: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in SeaFood Company = 1.4 versions...
Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048
The Formatter Field module provides a mechanism for specifying a formatter and formatter settings to be used for displaying a field, on a per-entity basis. formatterfield stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can...
CVE-2025-69127: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Plumbing = 1.6 versions...
CVE-2026-40757: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Château = 1.2.1 versions...
CVE-2026-39446: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Kapee 1.7.0 versions...
Drupal core - Critical - PHP object injection - SA-CORE-2026-005
SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web services. The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially inject a malicious payload in certain...
CVE-2026-40756: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Zoya = 1.4 versions...
CVE-2026-40755: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in TechLink = 1.3 versions...
CVE-2026-39567: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Santé = 1.5.1 versions...
CVE-2026-49108: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Moderno 1.43 versions...
CVE-2026-40752: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Manufaktur Solutions = 1.1.1 versions...
CVE-2026-40738: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Eldon = 1.4.1 versions...
CVE-2026-39576: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in SingleMalt = 1.5 versions...
CVE-2026-39560: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Hiroshi = 1.5.1 versions...
CVE-2026-39556: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Konsept = 1.9 versions...
CVE-2026-39445: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Alukas 3.0.0 versions...