5668 matches found
PT-2026-50407
Unauthenticated PHP Object Injection in Zoya = 1.4 versions...
CVE-2026-39557: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in NeoBeat = 1.7 versions...
PT-2026-50404
Name of the Vulnerable Software and Affected Versions ShiftUp versions 1.3 and earlier Description An unauthenticated PHP Object Injection issue exists in the software. PHP Object Injection occurs when user-supplied input is passed to the unserialize function without proper validation, potentiall...
PT-2026-50396
Unauthenticated PHP Object Injection in Alukas 3.0.0 versions...
PT-2026-50305
Unauthenticated PHP Object Injection in Mildhill = 1.5 versions...
CVE-2026-39573: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Mildhill = 1.5 versions...
CVE-2026-39560: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Hiroshi = 1.5.1 versions...
CVE-2025-60205: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trxaddons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1...
CVE-2026-40738: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Eldon = 1.4.1 versions...
Drupal core - Critical - PHP object injection - SA-CORE-2026-005
SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web services. The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially inject a malicious payload in certain...
CVE-2026-49107: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Thrive Apprentice 10.8.10.2 versions...
CVE-2026-49075: Deserialization of Untrusted Data
Contributor PHP Object Injection in JetEngine = 3.8.9.1 versions...
CVE-2026-27429: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Nifty = 1.4.1 versions...
CVE-2026-40759: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Esmée = 1.4 versions...
CVE-2026-40754: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Roisin = 1.4 versions...
CVE-2026-40739: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in LuxeDrive = 1.4 versions...
CVE-2026-40736: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Laurits = 1.5.1 versions...
CVE-2026-39578: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Valiance = 1.2 versions...