113810 matches found
VulnCheck KEV: CVE-2019-9041
An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzztemplate.php file, the parserIfLabel function's filtering is not strict, resulting in PHP code execution, as demonstrated by the if:assert substring...
CVE-2026-54856: ThemeREX RexCoin: Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.
Unauthenticated PHP Object Injection in RexCoin = 1.2.6 versions...
CVE-2026-54858: ThemeREX Printy: Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.
Unauthenticated PHP Object Injection in Printy = 1.13.0 versions...
CVE-2026-54857: ThemeREX Quirky: Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.
Unauthenticated PHP Object Injection in Quirky = 1.23 versions...
CVE-2026-61997: ThemeREX Legal Stone: Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.
Unauthenticated PHP Object Injection in Legal Stone = 1.2.11 versions...
CVE-2026-62002: ThemeREX Meals & Wheels: Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.
Unauthenticated PHP Object Injection in Meals & Wheels = 1.1.13 versions...
CVE-2026-62001: ThemeREX Marcell: Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.
Unauthenticated PHP Object Injection in Marcell = 1.2.14 versions...
CVE-2026-62005: ThemeREX Muzicon: Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.
Unauthenticated PHP Object Injection in Muzicon = 1.15 versions...
CVE-2026-61992: Von Eyal Fitoussi GEO my WordPress: Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.
Unauthenticated PHP Object Injection in GEO my WordPress = 4.5.5.3 versions...
CVE-2026-116865: Gesundheit Bewegt GmbH Zippy: Editor PHP Object Injection in Zippy <= 1.7.0 versions.
Editor PHP Object Injection in Zippy = 1.7.0 versions...
CVE-2026-118075: dbarrere WP Media folders: Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.
Contributor PHP Object Injection in WP Media folders = 1.1.10 versions...
CVE-2026-118073: blazethemes News Kit Elementor Addons: Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.
Subscriber PHP Object Injection in News Kit Elementor Addons = 1.5.0 versions...
ThemeREX Legal Stone deserialization injection vulnerability
ThemeREX Legal Stone versions 1.2.11 and earlier contain a deserialization injection vulnerability. This vulnerability stems from unauthenticated PHP object injection, which may lead to arbitrary code execution...
ThemeREX Orpheus deserialization injection vulnerability
ThemeREX Orpheus versions 1.8 and earlier contain a deserialization injection vulnerability. This vulnerability stems from unauthenticated PHP object injection...
ThemeREX Edge Decor deserialization injection vulnerability
ThemeREX Edge Decor versions 2.9 and earlier contain a deserialization injection vulnerability. This vulnerability stems from unauthenticated PHP object injection...
WordPress WP Media folder deserialization injection vulnerability
WordPress versions 1.1.10 and earlier contain a deserialization injection vulnerability. This vulnerability allows attackers with contributor privileges to trigger PHP object injection...
WordPress MasterStudy LMS path traversal vulnerability
WordPress MasterStudy LMS versions prior to 3.7.50 contain a path traversal vulnerability. This vulnerability stems from a lack of authorization checks; any authenticated user including subscribers can trigger the stmlmssendtestemailajax AJAX action without proper capability or nonce validation...
ThemeREX Gamezone deserialization injection vulnerability
ThemeREX Gamezone versions 1.1.11 and earlier contain a deserialization injection vulnerability. This vulnerability stems from unauthenticated PHP object injection...
PT-2026-132270
Unauthenticated PHP Object Injection in Ozisti = 1.1.10 versions...
PT-2026-132281
Name of the Vulnerable Software and Affected Versions Zoho Flow versions prior to 2.14.6 Description An unauthenticated attacker can send crafted input to the automation plugin to perform PHP Object Injection. This occurs when the application deserializes untrusted data, allowing the injection of...