CVE-2026-104723

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, ...

EUVD-2026-96118

The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution...

CVE-2026-104723 LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, ...

EUVD-2026-96108

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, ...

CVE-2026-104723

The LifterLMS WordPress plugin (versions

CVE-2026-104899

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress (versions up to and including 2.8.187 ) are vulnerable to Local File Inclusion (LFI) . The root cause is an insecure handling of the 'design_type' parameter , which allows unauthenticated attack...

CVE-2026-103889 3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter

The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpvimage' parameter parameter. This is due to missing authentication and nonce checks on the wploaded handler combined with no sanitization...

CVE-2025-69212-PoC

CVE-2025-69212 - OpenSTAManager OS Command Injection PoC Usage Install dependencies: pip install -r requirements.txt Run a single command and print its output: python3 cve-2025-69212poc.py -u http://target.com -U admin -P 'password' -c 'id' Drop a persistent PHP webshell instead: python3...

CVE-2026-17544-PoC

CVE-2026-17544 — PHP bcmath bccomp Out-of-Bounds-Write Stack-Smashing CVSS 9.8 Kritisch · CWE-787 · GHSA-x692-q9x7-8c3f Zusammenfassung bcstr2num in ext/bcmath/libbcmath/src/str2num.c mitgeliefertes libbcmath, PHP 8.4+ enthält einen Off-by-N-Out-of-Bounds-Write. Wenn die vom Benutzer angegebene...

CVE-2026-78529: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Alliance = 3.11 versions...

CVE-2026-42723: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in CleanSkin = 1.5.0 versions...

CVE-2026-42718: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Booster for WooCommerce = 8.4.0 versions...

PT-2026-109589

Name of the Vulnerable Software and Affected Versions Axiomthemes Balance versions prior to 1.12.1 Description The Axiomthemes Balance WordPress theme contains a flaw where it deserializes untrusted user-controlled data using the unserialize function. This allows for PHP object injection, where...

CVE-2026-66483: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Education Center = 3.6.12 versions...

PT-2026-109792

Name of the Vulnerable Software and Affected Versions Angio versions prior to 1.1.2 Description PHP Object Injection occurs in the Subscriber component, allowing an attacker to inject malicious objects into the application. Recommendations Update to a version newer than 1.1.1...

CVE-2026-62051: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Stargaze = 1.10 versions...

CVE-2026-66568: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Original = 1.9.0 versions...

CVE-2026-66564: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in ShiftCV = 3.0.14 versions...

CVE-2026-62124: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events = 2.21 versions...

PT-2026-109505

Name of the Vulnerable Software and Affected Versions Rank Math SEO versions prior to 1.0.280 Description The settings import feature fails to correctly validate the type of uploaded files. This allows users with administrator-level access to upload a PHP file, which can lead to remote code...