113755 matches found
CVE-2026-62012: ThemeREX Coinpress: Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.
Unauthenticated PHP Object Injection in Coinpress = 1.0.15 versions...
CVE-2026-62014: ThemeREX EmojiNation: Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.
Unauthenticated PHP Object Injection in EmojiNation = 1.0.12 versions...
CVE-2026-62015: ThemeREX Gamezone: Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.
Unauthenticated PHP Object Injection in Gamezone = 1.1.11 versions...
CVE-2026-62016: ThemeREX Gamic: Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.
Unauthenticated PHP Object Injection in Gamic = 1.19 versions...
CVE-2026-62017: ThemeREX Good Homes: Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.
Unauthenticated PHP Object Injection in Good Homes = 1.3.13 versions...
CVE-2026-62008: ThemeREX Orpheus: Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.
Unauthenticated PHP Object Injection in Orpheus = 1.8 versions...
CVE-2026-118076: Frisbii Frisbii Pay: Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.
Contributor PHP Object Injection in Frisbii Pay = 1.8.19 versions...
CVE-2026-118077: Fast Themes Sastra Essential Addons for Elementor: Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.
Author PHP Object Injection in Sastra Essential Addons for Elementor = 1.2.3 versions...
CVE-2026-118079: FolioVision FV Flowplayer Video Player: Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions.
Shop manager PHP Object Injection in FV Flowplayer Video Player = 8.3.4 versions...
PT-2026-132253
Shop manager PHP Object Injection in FV Flowplayer Video Player = 8.3.4 versions...
ThemeREX Marcell deserialization injection vulnerability
ThemeREX Marcell versions 1.2.14 and earlier contain a deserialization injection vulnerability. This vulnerability stems from unauthenticated PHP object injection...
CVE-2026-62131: Zoho Flow: Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.
Unauthenticated PHP Object Injection in Zoho Flow = 2.14.5 versions...
CVE-2026-42701: YayCommerce YayMail: Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.
Shop manager PHP Object Injection in YayMail = 4.4.6 versions...
WordPress Frisbii Pay deserialization injection vulnerability
WordPress Frisbii Pay versions 1.8.19 and earlier contain a deserialization injection vulnerability, which stems from PHP object injection...
CVE-2026-118081: 10Web 10Web Social Photo Feed: Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.
Contributor PHP Object Injection in 10Web Social Photo Feed = 1.5.6 versions...
ThemeREX Edge Decor deserialization injection vulnerability
ThemeREX Edge Decor versions 2.9 and earlier contain a deserialization injection vulnerability. This vulnerability stems from unauthenticated PHP object injection...
ICTBroadcast PHP-CGI/PHP-FPM cross-site scripting vulnerability
The ICTBroadcast PHP-CGI/PHP-FPM version contains a cross-site scripting vulnerability. This flaw arises because the editFormextensionusername parameter in the login.php endpoint is reflected without proper filtering, making it susceptible to cross-site scripting attacks. Such attacks could allow...
WordPress WP Media folder deserialization injection vulnerability
WordPress versions 1.1.10 and earlier contain a deserialization injection vulnerability. This vulnerability allows attackers with contributor privileges to trigger PHP object injection...
WordPress MasterStudy LMS path traversal vulnerability
WordPress MasterStudy LMS versions prior to 3.7.50 contain a path traversal vulnerability. This vulnerability stems from a lack of authorization checks; any authenticated user including subscribers can trigger the stmlmssendtestemailajax AJAX action without proper capability or nonce validation...
WordPress FV Flowplayer Video Player deserialization injection vulnerability
WordPress FV Flowplayer Video Player versions 8.3.4 and earlier contain a deserialization injection vulnerability. This vulnerability stems from PHP object injection in the Shop Manager component...