113810 matches found
php security update
5.4.16-48.0.1 - Backport fix for CVE-2026-109619 Orabug: 40200805...
ThemeREX Filmax deserialization injection vulnerability
ThemeREX Filmax versions 1.1.11 and earlier contain a deserialization injection vulnerability. This vulnerability stems from unauthenticated PHP object injection, which may lead to arbitrary code execution...
ThemeREX Coinpress deserialization injection vulnerability
ThemeREX Coinpress versions 1.0.15 and earlier contain a deserialization injection vulnerability. This vulnerability stems from unauthenticated PHP object injection, which may lead to object injection attacks...
ThemeREX Avventure deserialization injection vulnerability
ThemeREX Avventure versions 1.1.12 and earlier contain a deserialization injection vulnerability. This vulnerability stems from unauthenticated PHP object injection...
PT-2026-132168
MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stm lms send test email ajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly o...
PT-2026-132266
Unauthenticated PHP Object Injection in RexCoin = 1.2.6 versions...
ThemeREX Quirky deserialization injection vulnerability
ThemeREX Quirky versions 1.23 and earlier contain a deserialization injection vulnerability. This vulnerability stems from unauthenticated PHP object injection...
CVE-2026-116868: BuddyDev BuddyPress Xprofile Custom Field Types: Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.
Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types = 1.3.1 versions...
WordPress Zoho Flow deserialization injection vulnerability
WordPress Zoho Flow versions 2.14.5 and earlier contain a deserialization injection vulnerability. This vulnerability stems from unauthenticated PHP object injection...
CVE-2026-62003: ThemeREX Mission: Unauthenticated PHP Object Injection in Mission <= 1.22 versions.
Unauthenticated PHP Object Injection in Mission = 1.22 versions...
CVE-2026-118078: PixelYourSite Product Catalog Feed by PixelYourSite: Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.
Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite = 3.1.4 versions...
CVE-2026-54859: ThemeREX Preservation: Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.
Unauthenticated PHP Object Injection in Preservation = 1.15 versions...
CVE-2026-54860: ThemeREX Ozisti: Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.
Unauthenticated PHP Object Injection in Ozisti = 1.1.10 versions...
CVE-2026-62009: ThemeREX Filmax: Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.
Unauthenticated PHP Object Injection in Filmax = 1.1.11 versions...
CVE-2026-103693: Unknown: The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an…
The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to...
CVE-2026-62006: ThemeREX Nuts: Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.
Unauthenticated PHP Object Injection in Nuts = 1.12 versions...
PT-2026-133295
Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 3.1.3 Description An unauthenticated attacker can perform PHP Object Injection via a Post Custom Field with a List input type. The issue occurs because the GFFormsModel::create post function passes submitted...
ThemeREX Meals & Wheels deserialization injection vulnerability
ThemeREX Meals & Wheels versions 1.1.13 and earlier contain a deserialization injection vulnerability. This vulnerability stems from unauthenticated PHP object injection, which may allow attackers to carry out PHP object injection attacks...
CVE-2026-62013: ThemeREX Edge Decor: Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.
Unauthenticated PHP Object Injection in Edge Decor = 2.9 versions...
CVE-2026-118074: Daman Jeet Finale Lite: Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.
Shop manager PHP Object Injection in Finale Lite = 2.21.0 versions...