113731 matches found
PT-2026-50606
Name of the Vulnerable Software and Affected Versions Drupal core affected versions not specified Description An attacker with appropriate JSON:API write permissions could potentially inject a malicious payload in certain rare circumstances, leading to PHP Object Injection. PHP Object Injection...
CVE-2026-39568: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Mr. SEO = 2.0 versions...
PT-2026-50544
Name of the Vulnerable Software and Affected Versions PHP Standard Library PSL versions 6.1.0 through 6.1.1 PHP Standard Library PSL version 6.2.0 Description The PslH2ServerConnection function does not validate that the total bytes received in DATA frames match the content-length header declared...
CVE-2026-39560: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Hiroshi = 1.5.1 versions...
CVE-2025-69122: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in SeaFood Company = 1.4 versions...
WordPress Theme: neuronet: CVE-2025-58952: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Unauthenticated Local File Inclusion in Neuronet 1.14.0 versions...
CVE-2026-39580: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Micdrop = 1.3.1 versions...
CVE-2025-69146: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Dom = 1.24 versions...
CVE-2026-52706: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in JetEngine = 3.8.10 versions...
PT-2026-50404
Name of the Vulnerable Software and Affected Versions ShiftUp versions 1.3 and earlier Description An unauthenticated PHP Object Injection issue exists in the software. PHP Object Injection occurs when user-supplied input is passed to the unserialize function without proper validation, potentiall...
PT-2026-50531
Name of the Vulnerable Software and Affected Versions Pimcore CMS/DXP version 12.3.8 Description A sandbox bypass allows authenticated administrative attackers to execute arbitrary methods on PHP objects. This occurs due to empty checkMethodAllowed and checkPropertyAllowed implementations within...
CVE-2026-49108: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Moderno 1.43 versions...
CVE-2026-40756: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Zoya = 1.4 versions...
CVE-2026-39445: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Alukas 3.0.0 versions...
CVE-2026-54806: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in WP Activity Log = 5.6.3.1 versions...
CVE-2026-54194: Deserialization of Untrusted Data
Contributor PHP Object Injection in Fusion Builder = 3.15.4 versions...
CVE-2026-40739: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in LuxeDrive = 1.4 versions...
CVE-2026-40736: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Laurits = 1.5.1 versions...