CVE-2019-15521

Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object...

CVE-2019-15521

Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object...

Code injection

Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object...

CVE-2019-15521

Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object...

CVE-2019-15521

CVE-2019-15521 affects Spoon Library up to 2014-02-06 as used in Fork CMS before 1.4.1 and other products. The vulnerability enables PHP object injection via a cookie containing a serialized object, allowing code execution under deserialization in spoon/cookie/cookie.php. Public sources (Red Hat,...

CVE-2019-15521: Deserialization of Untrusted Data

Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object...

CVE-2018-20987

The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection...

Design/Logic Flaw

The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection...

CVE-2018-20987

The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection...

CVE-2018-20987

CVE-2018-20987 affects the Newsletters Lite WordPress plugin. The connected documents confirm a PHP object injection flaw in newsletters-lite before version 4.6.8.6, caused by an insecure deserialization condition in the plugin’s code path. This vulnerability can enable remote code execution or s...

CVE-2017-18583

The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection...

CVE-2017-18583

The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection...

CVE-2017-18583

CVE-2017-18583 affects the WordPress plugin post-pay-counter (before 2.731) with a PHP Object Injection flaw. The advisory sources identify this as a high/critical issue: CVSS v2 base score 7.5 (HIGH) and CVSS v3.0 base score 9.8 (CRITICAL) with network attack vector, no user interaction, and imp...

CVE-2017-18583: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection...

CVE-2018-20987: Deserialization of Untrusted Data

The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection...

Breaking Into Your Company's Internal Network - SuiteCRM 7.11.4

As part of our efforts to make the open source web application space more secure we scanned SuiteCRM 7.11.4 with our static code analysis tool RIPS and we detected multiple critical vulnerabilities. Among them is a SQL Injection that can be exploited as a normal user CVE-2019-12598, which can be...

Agent Tesla Panel Remote Code Execution

This module exploits a command injection vulnerability within the Agent Tesla control panel, in combination with an SQL injection vulnerability and a PHP object injection vulnerability, to gain remote code execution on affected hosts. Panel versions released prior to Sepetember 12, 2018 can be...

Unsafe Deserialization

shopware/shopware is vulnerable to XML external entity attacks via unsafe deserialization. The sort parameter in the function loadPreviewAction in the ShopwareControllersBackendProductStream controller is not validated before PHP object instantiation is performed, which would allow an attacker to...

CVE-2019-12799

In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code...

CVE-2019-12799

In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code...