CVE-2026-82222

CVE-2026-82222 — GiveWP Author: Rx019 CVSS: 10.0 Critical Type: Unauthenticated PHP Object Injection → Remote Code Execution Plugin: GiveWP give — Donation Plugin and Fundraising Platform Affected: Patched: 4.16.8 Description GiveWP stores a donor's lastname in the PHP session without sanitizatio...

Laravel-vul

Laravel-vul A POP chain discovered during personal audit of Laravel 5, Vulnerability ID: CVE-2021-43503 Details see issues...

CVE-2024-56058

CVE-2024-56058 VRPConnector = 2.0.1 - Injeção de Objeto PHP Não Autenticada Descrição O plugin VRPConnector para WordPress é vulnerável a Injeção de Objeto PHP nas versões até, e incluindo, 2.0.1 através da desserialização de entrada não confiável. Isso possibilita que atacantes não autenticados...

CVE-2024-56059

CVE-2024-56059 Partners = 0.2.0 – Nicht authentifizierte PHP-Objekt-Injektion Beschreibung Das Partners-Plugin für WordPress ist in Versionen bis einschließlich 0.2.0 anfällig für PHP-Objekt-Injektion durch Deserialisierung nicht vertrauenswürdiger Eingaben. Dadurch können nicht authentifizierte...

CVE-2026-14558

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...

CVE-2019-9081_PoC

CVE-2019-9081poc إثبات المفهوم لـ CVE-2019-9081، هذا CVE هو مجرد سلسلة POP جديدة. المشروع هو تطبيق Laravel 5.7.x ضعيف مسبق البناء مع نقطة دخول لثغرة POI في المسار /deserialize طلب POST. إعداد المختبر: بدء تشغيل التطبيق الضعيف: root@kitploit: $ git clone...

CVE-2020-28032_PoC

CVE-2020-28032PoC PoC für CVE-2020-28032 Es ist nur eine POP-Kette in WordPress RequestsUtilityFilteredIterator Object callback:protected = system storage:ArrayIterator:private = Array 0 = id uid=1000nth347 gid=1000nth347...

CVE-2019-9081_PoC

CVE-2019-9081poc PoC für CVE-2019-9081; diese CVE ist lediglich eine neue POP-Kette. Das Projekt ist eine vorgefertigte verwundbare Laravel 5.7.x-Anwendung mit einem Einstiegspunkt für die POI-Sicherheitslücke unter der URI /deserialize POST-Anfrage. Lab-Einrichtung: Starten der verwundbaren...

CVE-2021-43503

Avviso La vulnerabilità è stata revocata Override Questo riguarda CVE-2021-43503, non sono riuscito a replicare questa vulnerabilità attraverso exp Requisiti PHP 7.1. Composer registrar=$b; namespace Illuminate\Queue\Capsule class Manager protected $manager; public function construct$c...

CVE-2026-78572

The Kalles Addons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.6 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...

EUVD-2026-65355

The Kalles Addons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.6 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...

CVE-2026-78572

The Kalles Addons plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input in all versions up to and including 1.0.6 . An unauthenticated attacker can inject a PHP object. No known POP chain exists within the plugin itself, so the vulnerability has no impa...

CVE-2024-13784

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2024-13784

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2024-13784 Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

EUVD-2024-55720

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2024-13784

The CVE-2024-13784 entry concerns the WordPress plugin ARForms (Contact Form, Survey, Quiz & Popup Form Builder). Affected versions: all up to and including 1.8.5. Root cause: PHP Object Injection via deserialization of untrusted input from form submissions. Impact requires that a POP chain exist...

CVE-2026-10035

The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted input in the wvrbbpsettoserializedvalues function reached through the wvrbbpsaverestore settings-restore handler. The function...

CVE-2026-71294 Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions

Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via trim-only sanitization is passed to with no restriction, reachable by any member with wri...

EUVD-2026-37585

The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level...