5225 matches found
CVE-2026-78276: Deserialization of Untrusted Data
Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...
PT-2026-82462
Unauthenticated PHP Object Injection in Geo Controller = 8.9.8 versions...
CVE-2026-78292: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
CVE-2026-78257: Deserialization of Untrusted Data
Contributor PHP Object Injection in Booking and Rental Manager = 2.7.5 versions...
CVE-2026-78286: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Geo Controller = 8.9.8 versions...
CVE-2025-22777-GiveWP-Plugin-PHP-Object-Injection-Point-PoC-
CVE-2025-22777-GiveWP-Plugin-PHP-Object-Injection-Point-PoC- Questo repository contiene una Proof of Concept in lavorazione per CVE-2025-22777 che interessa il plugin GiveWP per WordPress. Le cose potrebbero cambiare, rompersi o migliorare nel tempo. Per prima cosa, clona questo repository. Sul t...
CVE-2026-80428
ILIAS (e-learning platform) is vulnerable to unauthenticated PHP object injection via its Shibboleth back-channel endpoint (shib_logout.php). The endpoint's logout-notification handler deserialises all live session rows without restricting constructable classes, and runs in a context exempt from ...
WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Boards Pro versions = 2.0.11...
CVE-2026-80428: Deserialization of Untrusted Data
ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth...
WordPress WS Form LITE – Drag & Drop Contact Form Builder plugin <= 1.10.80 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin WS Form LITE versions = 1.10.80...
CVE-2026-78572
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...
EUVD-2026-65355
The Kalles Addons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.6 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...
CVE-2026-78572
The Kalles Addons plugin for WordPress (versions up to and including 1.0.6 ) is vulnerable to PHP Object Injection via deserialization of untrusted input, allowing unauthenticated attackers to inject a PHP Object. No known POP chain exists within the plugin itself, so impact depends on whether an...
CVE-2026-78572
...
CVE-2026-77138
The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server...
CVE-2026-56095
The extension's indexer passed every field value returned by content object rendering through PHP's unserialize function when transferring multi-value data for the SOLRCLASSIFICATION, SOLRMULTIVALUE and SOLRRELATION content object types, rather than a safe format. If user-generated content saved ...
EUVD-2026-65350
The extension's indexer passed every field value returned by content object rendering through PHP's unserialize function when transferring multi-value data for the SOLRCLASSIFICATION, SOLRMULTIVALUE and SOLRRELATION content object types, rather than a safe format. If user-generated content saved ...
CVE-2026-56095 Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
The extension's indexer passed every field value returned by content object rendering through PHP's unserialize function when transferring multi-value data for the SOLRCLASSIFICATION, SOLRMULTIVALUE and SOLRRELATION content object types, rather than a safe format. If user-generated content saved ...
CVE-2026-56095 Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
The extension's indexer passed every field value returned by content object rendering through PHP's unserialize function when transferring multi-value data for the SOLRCLASSIFICATION, SOLRMULTIVALUE and SOLRRELATION content object types, rather than a safe format. If user-generated content saved ...