CVE-2020-28032_PoC

CVE-2020-28032PoC PoC for CVE-2020-28032 It's just a POP chain in WordPress RequestsUtilityFilteredIterator Object callback:protected = system storage:ArrayIterator:private = Array 0 = id uid=1000nth347 gid=1000nth347...

vulnerable-bsr-lab-CVE-2023-6933

CVE-2023-6933 Vulnerability Lab Overview This laboratory environment demonstrates CVE-2023-6933, a critical PHP Object Injection vulnerability in the Better Search Replace WordPress plugin versions ≤1.4.4. Vulnerability Details CVE ID : CVE-2023-6933 CVSS Score : 9.8 Critical Affected Plugin :...

CVE-2026-48909-Joomla-SP-Exploit

CVE-2026-48909 Joomla SP LMS — Unauthenticated PHP Object Injection → RCE Proof-of-concept assessment tool for CVE-2026-48909 Author: Sudeepa Wanigarathna !IMPORTANT Authorized use only. This tool is for security research, education, and testing systems you own or have explicit written permission...

VulnCheck KEV: CVE-2026-18391

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain...

CVE-2024-8353-PoC

Proof-Of-Concept Code for CVE-2024-8353 This repository contains a script for exploiting the CVE-2024-8353 vulnerability in the GiveWP plugin for WordPress. This vulnerability allows unauthenticated PHP Object Injection, potentially leading to remote code execution. Overview The provided scripts...

PoC-Funcional---CVE-2026-45247-Mirasvit-Full-Page-Cache-Warmer-RCE-

CVE-2026-45247 - Mirasvit Full Page Cache Warmer for Magento 2 - PHP Object Injection → RCE -red 📋 Description CVE-2026-45247 is a critical PHP Object Injection vulnerability in the Mirasvit Full Page Cache Warmer extension for Magento 2 and Adobe Commerce. An unauthenticated attacker can achieve...

CVE-2024-49699

CVE-2024-49699 ARPrice = 4.0.3 - Authenticated Subscriber+ PHP Object Injection Description The ARPrice plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.0.3 via deserialization of untrusted input. This makes it possible for authenticated attackers, wi...

CVE-2025-49113

CVE-2025-49113 – Roundcube Webmail RCE Exploit Python PoC CVE ID: CVE-2025-49113 Exploit Type: Remote Code Execution via PHP Object Injection Application: Roundcube Webmail ≤ 1.5.9 and ≤ 1.6.10 Exploit Language: Python Author: 00xCanelo Status: Tested and Working on Vulnerable Roundcube...

WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by AndrewN in WordPress Plugin Affiliates versions = 7.0.1...

WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin SureCart versions = 4.9.3...

WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Polylang versions = 3.8.9...

CVE-2023-6933

Introduction to CVE-2023-6933 Vulnerability Description The "Better Search Replace" plugin for WordPress exhibits a critical vulnerability known as PHP Object Injection. This security flaw is present in all versions up to and including 1.4.4. It arises from the deserialization of untrusted input,...

CVE-2026-82222

CVE-2026-82222 — GiveWP Author: Rx019 CVSS: 10.0 Critical Type: Unauthenticated PHP Object Injection → Remote Code Execution Plugin: GiveWP give — Donation Plugin and Fundraising Platform Affected: Patched: 4.16.8 Description GiveWP stores a donor's lastname in the PHP session without sanitizatio...

cotonti-commentswidget-poc

Cotonti CommentsWidget PHP Object Injection PoC Safe local proof of concept for the PHP object injection issue identified in Cotonti's CommentsWidget implementation. Vulnerability Project: Cotonti Affected component: plugins/comments/inc/CommentsWidget.php CWE: CWE-502 — Deserialization of...

CVE-2022-24087

CVE-2022-24087-RCE and CVE-2022-24086-RCE CVE description CVE-2022-24086 and CVE-2022-24087 - improper Input Validation vulnerability in contact form Magento Open Source and Adobe Commerce - has received a CVSS score of 9.8 out of 10, it is classified as a pre-authentication issue which means tha...

CVE-2025-22777

CVE-2025-22777 GiveWP – Donation Plugin and Fundraising Platform = 3.19.3 - Unauthenticated PHP Object Injection Description The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.3 via...

cve-2026-82222-poc

CVE-2026-82222 Unauthenticated PHP object injection to RCE in GiveWP & % in the command; spaces become $IFS. Pass a form id if discovery misses. Pass -g if the script cannot find an enabled gateway. The donation request often returns HTTP 500 or times out. That is expected. The session write...

CVE-2024-1813-POC

CVE-2024-1813 - Simple Job Board ≤ 2.11.0 WordPress - Unauthenticated PHP Object Injection 🎥 Proof-of-Concept demo End-to-end: a guest stores a serialized PHP object through the public application form, the admin opens the applicants list, and the gadget chain drops a webshell. Unauthenticated PH...

CVE-2026-9691

CVE-2026-9691 CVE-2026-9691: Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms = 1.1.1 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule...

CVE-2024-52433

CVE-2024-52433 My Geo Posts Free = 1.2 - Unauthenticated PHP Object Injection Description The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated...