Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via filename handling in the Gitblame, Hgblame, and Svnblame report generators. An attacker can execute arbitrary shell commands by supplying an untrusted file whose name contains shell metacharacters. When...

EUVD-2026-53825

A security vulnerability has been detected in SourceCodester Computer Repair Shop Management System 1.0. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=deleteproduct. Such manipulation of the argument ID leads to sql injection. It is possible to launch the...

CVE-2026-19021 SourceCodester Computer Repair Shop Management System Master.php delete_product sql injection

A security vulnerability has been detected in SourceCodester Computer Repair Shop Management System 1.0. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=deleteproduct. Such manipulation of the argument ID leads to sql injection. It is possible to launch the...

PT-2026-68774

Impact PHP CodeSniffer versions before v3.13.6 and v4.0.2 contain a command injection vulnerability in the code creating the Gitblame, Hgblame and Svnblame reports. As a result, running PHP CodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer...

PT-2026-68565

Name of the Vulnerable Software and Affected Versions Adrena versions prior to 1.2.15 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadget...

CVE-2026-65576: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Adrena = 1.2.14 versions...

CVE-2026-65577: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Advice = 1.18.0 versions...

CVE-2026-65552: Deserialization of Untrusted Data

Subscriber PHP Object Injection in Export User Data = 2.2.6 versions...

PT-2026-68568

Name of the Vulnerable Software and Affected Versions Agricola versions prior to 1.22.0 Description The Agricola - Agriculture & Organic Farm Theme for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. PHP Object Injection...

CVE-2026-65579: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Agricola = 1.21.0 versions...

Security update for php8 (critical)

openSUSE security update: security update for php8 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21532-1 Rating: critical References: bsc1273075 bsc1273076 bsc1273077 bsc1273078 Cross-References: CVE-2026-17543 CVE-2026-17544 CVE-2026-7260...

PT-2026-68562

Name of the Vulnerable Software and Affected Versions Abelle versions prior to 1.23 Description The Abelle theme for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. Deserialization is the process of converting a stored dat...

PT-2026-68561

Name of the Vulnerable Software and Affected Versions A.Williams versions prior to 1.3.2 Description The A.Williams plugin for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. This issue occurs when the application processe...

PT-2026-68560

Name of the Vulnerable Software and Affected Versions 69 Clothing versions prior to 1.2.11.2 Description The 69 Clothing | Brand Store & Fashion Boutique WordPress Theme is susceptible to PHP Object Injection, a condition where an application deserializes untrusted input, allowing an attacker to...

PT-2026-68564

Name of the Vulnerable Software and Affected Versions Accalia versions prior to 1.5.4 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadget...

CVE-2026-65581: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in AI ANN = 1.29.0 versions...

CVE-2026-65578: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Agora = 1.9 versions...

CVE-2026-65571: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in 69 Clothing = 1.2.11.1 versions...

CVE-2026-65556: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in WPBruiser no- Captcha anti-Spam = 3.1.43 versions...

SUSE SLES15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2026:3510-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3510-1 advisory. - CVE-2026-7260: Stack overflow in phar with circular symlinks bsc1273077. - CVE-2026-9672: Upgrade libgd bsc1273078. -...