CVE-2026-19092: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output...

CVE-2026-78286: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Geo Controller = 8.9.8 versions...

CVE-2026-78276: Deserialization of Untrusted Data

Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-78292: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...

CVE-2026-78257: Deserialization of Untrusted Data

Contributor PHP Object Injection in Booking and Rental Manager = 2.7.5 versions...

PT-2026-84464

Name of the Vulnerable Software and Affected Versions Composer versions 1.0 through 2.2.29 Composer versions 2.10.0 through 2.10.2 Description Composer, a dependency manager for PHP, fails to validate the source.url when source.type is set to perforce. A malicious package from a custom repository...

PT-2026-82739

Name of the Vulnerable Software and Affected Versions MongoDB client library for PHP affected versions not specified Description The MongoDB client library for PHP fails to properly sanitize special elements within application-supplied namespace identifiers used to construct target namespaces for...

PT-2026-82654

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.6 Description The Tutor LMS WordPress plugin contains a template injection issue caused by insufficient validation of request data. This allows unauthenticated users to overwrite internal variables during templa...

TencentOS Server 3: php:8.2 (TSSA-2026:0930)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0930 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

MiracleLinux 9 : php:8.3 (AXSA:2026-1659:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1659:01 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar...

CVE-2025-22777-GiveWP-Plugin-PHP-Object-Injection-Point-PoC-

CVE-2025-22777-GiveWP-Plugin-PHP-Object-Injection-Point-PoC- Questo repository contiene una Proof of Concept in lavorazione per CVE-2025-22777 che interessa il plugin GiveWP per WordPress. Le cose potrebbero cambiare, rompersi o migliorare nel tempo. Per prima cosa, clona questo repository. Sul t...

GHSA-7W8C-QGXG-M7JX LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates

Summary Multiple legacy PHP template files in LibreNMS directly output SNMP-sourced and syslog-sourced data into HTML without escaping. An attacker who controls a monitored network device via compromised SNMP agent or syslog sender can inject arbitrary JavaScript that executes when any...

Cross-site Scripting (XSS)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS via unescaped output of attacker-controlled SNMP and syslog data in legacy PHP templates. An...

CVE-2026-35445

Winter CMS versions prior to 1.2.13 contained an authorization bypass in the backend's form postback handler dispatch. The _handler POST field was passed directly to the handler dispatcher without validation, unlike AJAX requests which enforced the on[A-Z][\w+]* pattern. This allowed any authenti...

CVE-2026-80428

ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth...

CVE-2026-80428

ILIAS (e-learning platform) is vulnerable to unauthenticated PHP object injection via its Shibboleth back-channel endpoint (shib_logout.php). The endpoint's logout-notification handler deserialises all live session rows without restricting constructable classes, and runs in a context exempt from ...

EUVD-2026-66597

DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className to constructor...

WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Boards Pro versions = 2.0.11...

Exploit for CVE-2026-56705

CVE-2026-56705 – Adminer MSSQL DSN Injection Mass Exploiter...

CVE-2026-80428: Deserialization of Untrusted Data

ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth...