111818 matches found
CVE-2026-37068
Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...
PT-2026-82462
Unauthenticated PHP Object Injection in Geo Controller = 8.9.8 versions...
CVE-2026-78286: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Geo Controller = 8.9.8 versions...
e-SIC Livre 0.2.2 Resource Consumption
e-SIC Livre versions 0.2.2 and below suffer from a resource consumption vulnerability in the CAPTCHA generation component. CVE-2026-50787 — Uncontrolled Resource Consumption in e-SIC Livre Summary A resource consumption vulnerability exists in the CAPTCHA generation component of e-SIC Livre...
PT-2026-82451
Name of the Vulnerable Software and Affected Versions Booking and Rental Manager versions prior to 2.7.6 Description An issue exists that allows for PHP Object Injection, a technique where an attacker leverages the deserialization of untrusted data to instantiate arbitrary objects and execute...
PT-2026-82458
Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...
PT-2026-82739
Name of the Vulnerable Software and Affected Versions MongoDB client library for PHP affected versions not specified Description The MongoDB client library for PHP fails to properly sanitize special elements within application-supplied namespace identifiers used to construct target namespaces for...
CVE-2026-78292: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
CVE-2026-37068
Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...
PT-2026-82654
Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.6 Description The Tutor LMS WordPress plugin contains a template injection issue caused by insufficient validation of request data. This allows unauthenticated users to overwrite internal variables during templa...
CVE-2026-19092: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output...
CVE-2025-22777-GiveWP-Plugin-PHP-Object-Injection-Point-PoC-
CVE-2025-22777-GiveWP-Plugin-PHP-Object-Injection-Point-PoC- Questo repository contiene una Proof of Concept in lavorazione per CVE-2025-22777 che interessa il plugin GiveWP per WordPress. Le cose potrebbero cambiare, rompersi o migliorare nel tempo. Per prima cosa, clona questo repository. Sul t...
Cross-site Scripting (XSS)
Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS via unescaped output of attacker-controlled SNMP and syslog data in legacy PHP templates. An...
GHSA-7W8C-QGXG-M7JX LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates
Summary Multiple legacy PHP template files in LibreNMS directly output SNMP-sourced and syslog-sourced data into HTML without escaping. An attacker who controls a monitored network device via compromised SNMP agent or syslog sender can inject arbitrary JavaScript that executes when any...
CVE-2026-35445
Winter CMS versions prior to 1.2.13 contained an authorization bypass in the backend's form postback handler dispatch. The _handler POST field was passed directly to the handler dispatcher without validation, unlike AJAX requests which enforced the on[A-Z][\w+]* pattern. This allowed any authenti...
CVE-2026-80428
ILIAS (e-learning platform) is vulnerable to unauthenticated PHP object injection via its Shibboleth back-channel endpoint (shib_logout.php). The endpoint's logout-notification handler deserialises all live session rows without restricting constructable classes, and runs in a context exempt from ...
CVE-2026-80428
ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth...
EUVD-2026-66597
DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className to constructor...
WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Boards Pro versions = 2.0.11...
