Exploit for CVE-2026-115560

CVE-2026-115560 — PHP session upload progress serialize-handle...

PHP 8.5.11 Pre-RINIT Session Unserialize Code Execution

PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain a pre-RINIT session upload-progress unserialization issue that can invoke magic methods on a preloaded gadget class. The proof of concept seeds a session file using a phpserialize endpoint and triggers decoding through a php...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

CVE-2026-109619-POC Pre-RINIT session unserialize RCE in PHP...

PT-2026-120956

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.6.20 Roundcube Webmail versions 1.7.x prior to 1.7.5 Description An object injection primitive exists in the rcube session::unserialize function. When a session key is prefixed with a “!” character, it is...

CVE-2026-56700 Grav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command Injection

Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize calls - in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session - deserialize untrusted data without restricting allowed classes, enabling PHP object injection and, via a gadget...

CVE-2025-34205

Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 VA and SaaS deployments contains dangerous PHP dead code present in multiple Docker-hosted PHP instances. A script named /var/www/app/resetroot.php found in several containers...

Immunity Canvas: JOOMLA_SESSION_UNSERIALIZE

Name| joomlasessionunserialize ---|--- CVE| CVE-2015-8562 Exploit Pack| CANVAS Description| Joomla session unserialize 1.5 to 3.4.5 Notes| Repeatability: Infinite VENDOR: Joomla CVE Url: https://vulners.com/cve/CVE-2015-8562 CVE Name: CVE-2015-8562...