CVE-2026-16767 Ne-Lexa php-zip ZIP ZipFile.php extractTo path traversal

A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal. It is possible to initiate the attack remotely. The...

CVE-2026-16765

A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of the argument aid can lead to sql injection. The attack can be executed remotely. The exploit has been...

CVE-2026-65497 WordPress Complianz plugin <= 7.5.0 - PHP Object Injection vulnerability

Administrator PHP Object Injection in Complianz = 7.5.0 versions...

CVE-2026-65497

CVE-2026-65497 concerns the WordPress Complianz plugin, affected in versions ≤ 7.5.0, with a PHP Object Injection vulnerability identifiable under the described Administrator context. The root cause is a PHP object injection flaw within Complianz that could be exploited via a network attack vecto...

CVE-2026-65497

Administrator PHP Object Injection in Complianz = 7.5.0 versions...

CVE-2026-65493

Subscriber PHP Object Injection in Dokan Pro = 5.0.2 versions...

CVE-2026-65493 WordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in Dokan Pro = 5.0.2 versions...

CVE-2026-59544 WordPress Thrive Quiz Builder plugin <= 10.9.3.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Thrive Quiz Builder = 10.9.3.0 versions...

EUVD-2026-48197

Unauthenticated PHP Object Injection in Thrive Quiz Builder = 10.9.3.0 versions...

CVE-2026-59544

The CVE covers WordPress Thrive Quiz Builder plugin versions

CVE-2026-15011

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...

WordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Expatch in WordPress Plugin Dokan Pro versions = 5.0.2...

Exploit for OS Command Injection in Php

CVE-2024-4577 - PHP CGI Argument Injection on Windows "WorstF...

Malicious code in intercom-php (Packagist)

Source: google-open-source-security 0bd33abd6fda35e856f8346fda5e85913ce2cad6b4d6c315a2e7138b867760aa This package is malicious and was compromised as part of the Mini Shai-Hulud campaign by the TeamPCP threat actor. The malicious payload steals credentials, and can propogate to NPM packages using...

CVE-2026-16767: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal. It is possible to initiate the attack remotely. The...

CVE-2026-65497: Deserialization of Untrusted Data

Administrator PHP Object Injection in Complianz = 7.5.0 versions...

CVE-2026-65493: Deserialization of Untrusted Data

Subscriber PHP Object Injection in Dokan Pro = 5.0.2 versions...

CVE-2026-65481: Improper Control of Filename for Include/Require Statement in PHP Program

Contributor Local File Inclusion in Vino = 1.9 versions...

CVE-2026-59544: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Thrive Quiz Builder = 10.9.3.0 versions...

MiracleLinux 9 : php:8.3 (AXSA:2026-1333:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1333:01 advisory. PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions CVE-2026-7258 PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting...