CVE-2025-60205 WordPress ThemeREX Addons plugin <= 2.36.1.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trxaddons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1...

CVE-2025-60205 WordPress ThemeREX Addons plugin <= 2.36.1.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trxaddons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1...

Exploit for CVE-2026-7654

CVE-2026-7654...

CVE-2026-12115

The vulnerability CVE-2026-12115 affects the WordPress plugin Counter Box (versions up to 2.0.13). It allows PHP Object Injection via deserialization of untrusted input and requires authenticated access at Administrator+ level. Deserialization occurs automatically during the post-import redirect ...

CVE-2026-12115 Counter Box <= 2.0.13 - Authenticated (Administrator+) PHP Object Injection via Import

The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level...

Exploit for CVE-2026-49952

setup pip3 install Pillow torch torchvision run...

PT-2026-50305

Unauthenticated PHP Object Injection in Mildhill = 1.5 versions...

PT-2026-50408

Unauthenticated PHP Object Injection in Château = 1.2.1 versions...

PT-2026-50407

Unauthenticated PHP Object Injection in Zoya = 1.4 versions...

PT-2026-50409

Unauthenticated PHP Object Injection in Moderno 1.43 versions...

CVE-2026-40757: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Château = 1.2.1 versions...

CVE-2026-39556: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Konsept = 1.9 versions...

CVE-2025-69158: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Granola = 1.13 versions...

CVE-2026-40751: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Ashtanga = 1.2 versions...

CVE-2026-39567: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Santé = 1.5.1 versions...

CVE-2026-39539: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Alloggio - Hotel Booking = 2.1.2 versions...

CVE-2026-27429: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Nifty = 1.4.1 versions...

CVE-2026-12115: Deserialization of Untrusted Data

The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level...

CVE-2025-69108: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Hot Coffee = 1.7 versions...

CVE-2026-48979: Inconsistent Interpretation of HTTP Requests

PHP Standard Library PSL is set of APIs covering async, collections, networking, I/O, cryptography, terminal UI, etc. In versions 6.1.0, 6.1.1 and 6.2.0, the Psl\H2\ServerConnection does not validate that the total bytes received in DATA frames match the content-length header declared in the...