CVE-2026-107376

The webonyx graphql-php PHP implementation of the GraphQL specification is vulnerable to a stack overflow via uncontrolled recursion. Specifically, the GraphQL\Language\Parser performs recursive descent without a limit in parseSelectionSet , parseValueLiteral , and parseTypeReference . A remote a...

EUVD-2026-95133

webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser performs recursive descent without a recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference. A remote attacker can submit deeply nested selection sets, obje...

CVE-2026-107376 webonyx graphql-php: Unbounded recursion in parser causes stack overflow on crafted nested input

webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser performs recursive descent without a recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference. A remote attacker can submit deeply nested selection sets, obje...

WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Kalles versions = 1.1.7.1...

WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Avala versions = 1.1.4...

WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme WineShop versions = 3.20...

WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Equadio versions = 1.1.4...

WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Juno versions = 2.25...

WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme N7 | Golf Club Sports & Events versions = 2.21...

WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Invetex versions = 2.18...

WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Law Office versions = 3.20...

CVE-2026-36340

CVE-2026-36340 Remote Code Execution RCE Vulnerability in Krayin CRM v2.1.5 Remote Code Execution RCE Vulnerability in Krayin CRM v2.1.5 CVE: CVE-2026-36340 Severity: Critical Affected Product: Krayin CRM v2.1.5 Vulnerability Type: Remote Code Execution RCE Authentication Required: Yes Summary A...

CVE-2021-24307-all-in-one-seo-pack-admin-rce

Admin PHP unserialization RCE in All in one SEO pack CVE-2021-24307 Simple PoC of an admin authenticated RCE in AISEO = 4.1.0.1 provided as an example. Full write-up here: https://darkpills.com/php-unserialize-write-up-with-admin-rce-in-all-in-one-seo-pack-cve-2021-24307/ Usage: php exploit.php u...

CVE-2026-2058-PoC

CVE-2026-2058-PoC – CloudClassroom PHP Project SQL Injection Overview A SQL Injection vulnerability exists in the Post Query functionality of the CloudClassroom PHP Project v1.0. The vulnerability allows attackers to inject arbitrary SQL commands via the squeryx POST parameter, leading to databas...

CVE-2026-29861

CVE-2026-29861 🛡️ CVE Disclosure: CVE-2026-29861 — SQL Injection in PHP-MYSQL-User-Login-System Disclosure Date: 10 April 2026 CVE ID: CVE-2026-29861 Severity: CRITICAL CVSS 9.8 🧩 Summary A critical SQL Injection vulnerability exists in PHP-MYSQL-User-Login-System v1.0, specifically within the...

CVE-2026-107362 Server-Side Request Forgery in Malcolm

Malcolm file-upload component ships the upstream FilePond PHP server pqina/filepond-server-php largely unmodified: Dockerfile copies all upstream .php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download an...

EUVD-2026-95118

Malcolm file-upload component ships the upstream FilePond PHP server pqina/filepond-server-php largely unmodified: Dockerfile copies all upstream .php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download an...

CVE-2026-107362 Server-Side Request Forgery in Malcolm

Malcolm file-upload component ships the upstream FilePond PHP server pqina/filepond-server-php largely unmodified: Dockerfile copies all upstream .php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download an...

CVE-2026-107362

The Malcolm file-upload component is vulnerable to a Server-Side Request Forgery (SSRF) due to its inclusion of the upstream FilePond PHP server (pqina/filepond-server-php) with largely unmodified files. Specifically, the upstream index.php contains a fetch API route that uses curl (with FOLLOWLO...

CVE-2026-1560-Authenticated-Remote-Code-Execution-in-Lazy-Blocks-4.2.0

CVE-2026-1560 – Authenticated Remote Code Execution in Custom Block Builder – Lazy Blocks ≤ 4.2.0 Researcher : ZeYrOXxx Plugin : Custom Block Builder – Lazy Blocks Affected Versions : ≤ 4.2.0 Severity : High CVSS : 8.8 Vulnerability Type : Authenticated Remote Code Execution RCE Attack Vector :...