110579 matches found
CVE-2026-104899
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'designtype' parameter parameter. This makes it possible for unauthenticated attackers to include and...
CVE-2026-104723
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, ...
EUVD-2026-96118
The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution...
CVE-2026-104723 LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, ...
CVE-2026-104723
The LifterLMS WordPress plugin (versions
EUVD-2026-96108
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, ...
CVE-2026-104899
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress (versions up to and including 2.8.187 ) are vulnerable to Local File Inclusion (LFI) . The root cause is an insecure handling of the 'design_type' parameter , which allows unauthenticated attack...
CVE-2026-103889 3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter
The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpvimage' parameter parameter. This is due to missing authentication and nonce checks on the wploaded handler combined with no sanitization...
CVE-2025-69212-PoC
CVE-2025-69212 - OpenSTAManager OS Command Injection PoC Usage Install dependencies: pip install -r requirements.txt Run a single command and print its output: python3 cve-2025-69212poc.py -u http://target.com -U admin -P 'password' -c 'id' Drop a persistent PHP webshell instead: python3...
CVE-2026-17544-PoC
CVE-2026-17544 — PHP bcmath bccomp Out-of-Bounds-Write Stack-Smashing CVSS 9.8 Kritisch · CWE-787 · GHSA-x692-q9x7-8c3f Zusammenfassung bcstr2num in ext/bcmath/libbcmath/src/str2num.c mitgeliefertes libbcmath, PHP 8.4+ enthält einen Off-by-N-Out-of-Bounds-Write. Wenn die vom Benutzer angegebene...
CVE-2026-78529: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Alliance = 3.11 versions...
Linux Distros Unpatched Vulnerability : CVE-2026-106432
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4...
Linux Distros Unpatched Vulnerability : CVE-2026-106436
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an...
PT-2026-109799
Name of the Vulnerable Software and Affected Versions DirectoryPress versions 3.x and earlier Description An unauthenticated Local File Inclusion issue exists, allowing an attacker to include files from the local file system without authentication. Recommendations Update DirectoryPress to a versi...
PT-2026-109589
Name of the Vulnerable Software and Affected Versions Axiomthemes Balance versions prior to 1.12.1 Description The Axiomthemes Balance WordPress theme contains a flaw where it deserializes untrusted user-controlled data using the unserialize function. This allows for PHP object injection, where...
CVE-2026-62051: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Stargaze = 1.10 versions...
CVE-2026-66568: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Original = 1.9.0 versions...
CVE-2026-66564: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in ShiftCV = 3.0.14 versions...