5225 matches found
CVE-2026-56095 Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
The extension's indexer passed every field value returned by content object rendering through PHP's unserialize function when transferring multi-value data for the SOLRCLASSIFICATION, SOLRMULTIVALUE and SOLRRELATION content object types, rather than a safe format. If user-generated content saved ...
CVE-2026-77138 Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)
The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server...
CVE-2026-77138
CVE-2026-77138 affects the TYPO3 extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail) . The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safe processing, enabling PHP Object Injection . A remote, unauthenticated attacker can supply a ...
CVE-2026-77138 Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)
The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server...
EUVD-2026-65338
The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server...
WordPress Geo Controller plugin <= 8.9.8 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Geo Controller versions = 8.9.8...
WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by daroo in WordPress Plugin Booking and Rental Manager versions = 2.7.5...
WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Hash Form versions = 1.4.1...
EUVD-2026-65169
Unauthenticated PHP Object Injection in WP Project Manager = 4.0.6 versions...
EUVD-2026-65167
Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
EUVD-2026-65172
Unauthenticated PHP Object Injection in The Events Calendar = 6.17.2 versions...
CVE-2026-77138: Deserialization of Untrusted Data
The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server...
PT-2026-81224
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The indexer of the extension uses the PHP unserialize function to process field values returned by content object rendering when transferring multi-value data fo...
CVE-2026-56095: Deserialization of Untrusted Data
The extension's indexer passed every field value returned by content object rendering through PHP's unserialize function when transferring multi-value data for the SOLRCLASSIFICATION, SOLRMULTIVALUE and SOLRRELATION content object types, rather than a safe format. If user-generated content saved ...
PT-2026-81250
Name of the Vulnerable Software and Affected Versions Kalles Addons versions prior to 1.0.7 Description The Kalles Addons plugin for WordPress is susceptible to PHP Object Injection due to the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. The...
PT-2026-81238
Name of the Vulnerable Software and Affected Versions HTML5 Video Player vs. Powermail html5videoplayer powermail affected versions not specified Description The extension fails to safely process untrusted client input from an attacker-controlled cookie passed directly to the PHP unserialize...
CVE-2026-78265
Unauthenticated PHP Object Injection in The Events Calendar = 6.17.2 versions...
CVE-2026-78262
Unauthenticated PHP Object Injection in WP Project Manager = 4.0.6 versions...