113752 matches found
Public_Exploit-1--Wordpress-CVE-2021-29447
PublicExploit-1--Wordpress-CVE-2021-29447 CVE-2021-29447 is an authenticated XML External Entity XXE vulnerability in WordPress The vulnerability exists in the WordPress Media Library when WordPress is running on PHP 8 and the user has permission to upload media files. A specially crafted .wav fi...
php-stale-global-uaf
php2shell/php2dos - php-stale-global-uaf Someone on the internet can talk to your PHP site the same way a browser does, with no password. On last-affected PHP 8.5 they can force one request to die with a fatal error, then send a second request to the same worker. PHP 8.5 keeps a backtrace from th...
CVE-2026-90888
Unauthenticated PHP Object Injection in LeadSnap = 1.25 versions...
CVE-2026-78527
Contributor PHP Object Injection in GS Testimonial Slider = 3.3.10 versions...
CVE-2026-73186
Subscriber PHP Object Injection in Enable Media Replace = 4.2.2 versions...
CVE-2026-62121
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited...
CVE-2026-39738
Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Injection.This issue affects FunnelKit Automations: from n/a through 3.8.6.1...
CVE-2026-118089
Shop manager PHP Object Injection in Product Feed Manager = 7.14.1 versions...
CVE-2026-118090
Subscriber PHP Object Injection in MasterStudy LMS = 3.7.55 versions...
AdminNeo: version-cache array injection causes persistent denial of service
Summary AdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version parameter which PHP converts ...
GHSA-JM85-8CPP-9CJC AdminNeo: version-cache array injection causes persistent denial of service
Summary AdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version parameter which PHP converts ...
CVE-2026-59978
AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated "?script=version" endpoint accepts POST data without origin, CSRF or parameter-type validation. A "version" parameter becomes a PHP array that "bootstrap.inc.php" serializes into the...
php2shell-research-portfolio
PHP2Shell: RCE Research and Privilege Escalation Lab Overv...
upb-any-recursion-audit
upb Any-recursion audit Ruby / PHP / C bindings Status: Complete. Six recursion-guard checks across three independent implementations Ruby/PHP shared upb core, C's separate managed implementation, all falsified except the one already-public, already-patched Python CVE this audit was checking...
CVE-2025-49113
CVE-2025-49113 Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization...
CVE-2026-118090 WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in MasterStudy LMS = 3.7.55 versions...
CVE-2026-118090
The MasterStudy LMS WordPress plugin (versions
EUVD-2026-114316
Subscriber PHP Object Injection in MasterStudy LMS = 3.7.55 versions...
