113775 matches found
ThemeREX Gamezone deserialization injection vulnerability
ThemeREX Gamezone versions 1.1.11 and earlier contain a deserialization injection vulnerability. This vulnerability stems from unauthenticated PHP object injection...
WordPress Zippy deserialization injection vulnerability
WordPress Zippy versions 1.7.0 and earlier contain a deserialization injection vulnerability, which stems from PHP object injection...
PT-2026-132270
Unauthenticated PHP Object Injection in Ozisti = 1.1.10 versions...
PT-2026-132281
Name of the Vulnerable Software and Affected Versions Zoho Flow versions prior to 2.14.6 Description An unauthenticated attacker can send crafted input to the automation plugin to perform PHP Object Injection. This occurs when the application deserializes untrusted data, allowing the injection of...
WordPress Social Snap deserialization injection vulnerability
WordPress Social Snap versions 1.5.4 and earlier contain a deserialization injection vulnerability, which stems from PHP object injection...
PT-2026-132250
Contributor PHP Object Injection in Frisbii Pay = 1.8.19 versions...
VulnCheck KEV: CVE-2019-9041
An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzztemplate.php file, the parserIfLabel function's filtering is not strict, resulting in PHP code execution, as demonstrated by the if:assert substring...
CVE-2026-54856: ThemeREX RexCoin: Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.
Unauthenticated PHP Object Injection in RexCoin = 1.2.6 versions...
PHP 8.5.11 Remote Code Execution
PHP version 8.5.11 and earlier affected releases contain out-of-memory corruption and stale global state flaws that can allow unauthenticated remote code execution. This proof of concept targets PHP 8.4.26 with Apache. https://packetstorm.news/download/238177...
ThemeREX Gunslinger deserialization injection vulnerability
ThemeREX Gunslinger versions 1.11 and earlier contain a deserialization injection vulnerability. This vulnerability arises from the ease of PHP object injection when authentication is not required...
PT-2026-132269
Unauthenticated PHP Object Injection in Preservation = 1.15 versions...
ThemeREX Preservation deserialization injection vulnerability
ThemeREX Preservation versions 1.15 and earlier contain a deserialization injection vulnerability. This vulnerability arises from unvalidated PHP object injection, which may lead to execution of malicious code or unauthorized access to sensitive data...
RHEL 9 : php:8.3 (RHSA-2026:89111)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89111 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsi...
ThemeREX Orpheus deserialization injection vulnerability
ThemeREX Orpheus versions 1.8 and earlier contain a deserialization injection vulnerability. This vulnerability stems from unauthenticated PHP object injection...
Oracle Linux 7 : php (ELSA-2026-88693)
The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-88693 advisory. 5.4.16-48.0.1 - Backport fix for CVE-2026-109619 Orabug: 40200805 Tenable has extracted the preceding description block directly from the Oracle Linux security...
PT-2026-132264
Shop manager PHP Object Injection in YayMail = 4.4.6 versions...
PT-2026-132267
Unauthenticated PHP Object Injection in Quirky = 1.23 versions...
PT-2026-132268
Unauthenticated PHP Object Injection in Printy = 1.13.0 versions...