EUVD-2026-65355

The Kalles Addons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.6 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...

CVE-2026-78572

The Kalles Addons plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input in all versions up to and including 1.0.6 . An unauthenticated attacker can inject a PHP object. No known POP chain exists within the plugin itself, so the vulnerability has no impa...

CVE-2023-46304

CVE-2023-46304 Esecuzione di codice in modalità remota autenticata in VTiger Open Source CRM v7.5 Riepilogo Esiste una vulnerabilità nel modulo Users della versione attuale di VTiger CRM Open Source 7.5.0 che consente a un utente autenticato di scrivere ed eseguire codice PHP arbitrario in...

CVE-2026-78562

The Verdure Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used...

CVE-2026-78566

The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to...

CVE-2026-77138

The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server...

CVE-2026-56095

The extension's indexer passed every field value returned by content object rendering through PHP's unserialize function when transferring multi-value data for the SOLRCLASSIFICATION, SOLRMULTIVALUE and SOLRRELATION content object types, rather than a safe format. If user-generated content saved ...

EUVD-2026-65350

The extension's indexer passed every field value returned by content object rendering through PHP's unserialize function when transferring multi-value data for the SOLRCLASSIFICATION, SOLRMULTIVALUE and SOLRRELATION content object types, rather than a safe format. If user-generated content saved ...

CVE-2026-56095 Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

The extension's indexer passed every field value returned by content object rendering through PHP's unserialize function when transferring multi-value data for the SOLRCLASSIFICATION, SOLRMULTIVALUE and SOLRRELATION content object types, rather than a safe format. If user-generated content saved ...

CVE-2026-56095

The Apache Solr for TYPO3 – Enterprise Search (solr) extension is affected by an insecure deserialization flaw in its indexer. When transferring multi-value data for the SOLR_CLASSIFICATION , SOLR_MULTIVALUE , and SOLR_RELATION content object types, every field value returned by content object re...

CVE-2026-56095 Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

The extension's indexer passed every field value returned by content object rendering through PHP's unserialize function when transferring multi-value data for the SOLRCLASSIFICATION, SOLRMULTIVALUE and SOLRRELATION content object types, rather than a safe format. If user-generated content saved ...

CVE-2026-77138

CVE-2026-77138 affects the TYPO3 extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail) . The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safe processing, enabling PHP Object Injection . A remote, unauthenticated attacker can supply a ...

CVE-2026-77138 Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)

The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server...

EUVD-2026-65338

The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server...

EUVD-2026-65326

The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to...

EUVD-2026-65325

The Verdure Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used...

WordPress Geo Controller plugin <= 8.9.8 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Geo Controller versions = 8.9.8...

WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin Booking and Rental Manager versions = 2.7.5...

WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Hash Form versions = 1.4.1...

CVE-2024-6330

CVE-2024-6330 GEO my WordPress = 4.5.0.1 - Inclusione di File Locale non autenticata Descrizione Il plugin GEO my WP per WordPress è vulnerabile all'Inclusione di File Locale in tutte le versioni fino alla 4.5.0.1 inclusa tramite il parametro 'forminfowindowtemplatecontentpath'. Ciò consente a...