113812 matches found
ThemeREX Preservation deserialization injection vulnerability
ThemeREX Preservation versions 1.15 and earlier contain a deserialization injection vulnerability. This vulnerability arises from unvalidated PHP object injection, which may lead to execution of malicious code or unauthorized access to sensitive data...
PT-2026-132250
Contributor PHP Object Injection in Frisbii Pay = 1.8.19 versions...
VulnCheck KEV: CVE-2019-9041
An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzztemplate.php file, the parserIfLabel function's filtering is not strict, resulting in PHP code execution, as demonstrated by the if:assert substring...
CVE-2026-54856: ThemeREX RexCoin: Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.
Unauthenticated PHP Object Injection in RexCoin = 1.2.6 versions...
CVE-2026-54858: ThemeREX Printy: Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.
Unauthenticated PHP Object Injection in Printy = 1.13.0 versions...
CVE-2026-54857: ThemeREX Quirky: Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.
Unauthenticated PHP Object Injection in Quirky = 1.23 versions...
CVE-2026-61997: ThemeREX Legal Stone: Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.
Unauthenticated PHP Object Injection in Legal Stone = 1.2.11 versions...
CVE-2026-62002: ThemeREX Meals & Wheels: Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.
Unauthenticated PHP Object Injection in Meals & Wheels = 1.1.13 versions...
CVE-2026-62001: ThemeREX Marcell: Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.
Unauthenticated PHP Object Injection in Marcell = 1.2.14 versions...
CVE-2026-62005: ThemeREX Muzicon: Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.
Unauthenticated PHP Object Injection in Muzicon = 1.15 versions...
CVE-2026-61992: Von Eyal Fitoussi GEO my WordPress: Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.
Unauthenticated PHP Object Injection in GEO my WordPress = 4.5.5.3 versions...
CVE-2026-116865: Gesundheit Bewegt GmbH Zippy: Editor PHP Object Injection in Zippy <= 1.7.0 versions.
Editor PHP Object Injection in Zippy = 1.7.0 versions...
CVE-2026-118075: dbarrere WP Media folders: Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.
Contributor PHP Object Injection in WP Media folders = 1.1.10 versions...
CVE-2026-118073: blazethemes News Kit Elementor Addons: Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.
Subscriber PHP Object Injection in News Kit Elementor Addons = 1.5.0 versions...
ThemeREX Legal Stone deserialization injection vulnerability
ThemeREX Legal Stone versions 1.2.11 and earlier contain a deserialization injection vulnerability. This vulnerability stems from unauthenticated PHP object injection, which may lead to arbitrary code execution...
ThemeREX Orpheus deserialization injection vulnerability
ThemeREX Orpheus versions 1.8 and earlier contain a deserialization injection vulnerability. This vulnerability stems from unauthenticated PHP object injection...
ThemeREX Edge Decor deserialization injection vulnerability
ThemeREX Edge Decor versions 2.9 and earlier contain a deserialization injection vulnerability. This vulnerability stems from unauthenticated PHP object injection...
WordPress WP Media folder deserialization injection vulnerability
WordPress versions 1.1.10 and earlier contain a deserialization injection vulnerability. This vulnerability allows attackers with contributor privileges to trigger PHP object injection...
WordPress MasterStudy LMS path traversal vulnerability
WordPress MasterStudy LMS versions prior to 3.7.50 contain a path traversal vulnerability. This vulnerability stems from a lack of authorization checks; any authenticated user including subscribers can trigger the stmlmssendtestemailajax AJAX action without proper capability or nonce validation...
ThemeREX Gamezone deserialization injection vulnerability
ThemeREX Gamezone versions 1.1.11 and earlier contain a deserialization injection vulnerability. This vulnerability stems from unauthenticated PHP object injection...