PT-2026-122575

Name of the Vulnerable Software and Affected Versions Muzicon versions prior to 1.16 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadgets...

PT-2026-122586

Name of the Vulnerable Software and Affected Versions Good Homes versions prior to 1.3.14 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of...

PT-2026-122581

Name of the Vulnerable Software and Affected Versions Coinpress versions prior to 1.0.16 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of...

PT-2026-122584

Name of the Vulnerable Software and Affected Versions Gamezone versions prior to 1.1.12 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of...

PT-2026-122571

Name of the Vulnerable Software and Affected Versions Le Truffe versions prior to 1.1.8 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of...

PT-2026-122585

Name of the Vulnerable Software and Affected Versions Gamic versions prior to 1.20 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadgets...

PT-2026-122583

Name of the Vulnerable Software and Affected Versions EmojiNation versions prior to 1.0.13 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of...

PT-2026-122577

Name of the Vulnerable Software and Affected Versions Orpheus versions prior to 1.9 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadgets...

PT-2026-122573

Name of the Vulnerable Software and Affected Versions Mission versions prior to 1.23 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadgets...

PT-2026-122572

Name of the Vulnerable Software and Affected Versions Meals & Wheels versions prior to 1.1.14 Description Unauthenticated attackers can perform PHP Object Injection due to the deserialization of untrusted input. While no POP chain a sequence of gadgets used to achieve code execution is present in...

PT-2026-122576

Name of the Vulnerable Software and Affected Versions Nuts versions prior to 1.13 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadgets us...

PT-2026-122587

Name of the Vulnerable Software and Affected Versions Gunslinger versions prior to 1.12 Description The Gunslinger theme for WordPress allows unauthenticated attackers to perform PHP Object Injection due to the deserialization of untrusted input. This occurs when the application processes data th...

PT-2026-122574

Name of the Vulnerable Software and Affected Versions Motorix versions prior to 1.12 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadgets...

CVE-2026-12872

The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files including PHP to a web-accessible directory, leading to...

OPEXUS eComplaint security vulnerabilities

OPEXUS eComplaint is a complaint and appeal management platform provided by the US company OPEXUS. Versions of OPEXUS eComplaint prior to 10.1.0.0 contained security vulnerabilities. These vulnerabilities allowed unauthenticated attackers to upload arbitrary files, potentially leading to storage...

CVE-2025-14532

DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution. This issue was fixed in versions above 5.0...

CVE-2026-1458

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an unauthenticated user to cause denial of service by uploading malicious files...

CVE-2026-1458

Removed by vendor...

CVE-2025-15226 Sunnet｜WMPro - Arbitrary File Upload

WMPro developed by Sunnet has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2025-14390

The Video Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in version = 5.0.4. This is due to missing or incorrect nonce validation on the videomerchantaddvideofile function. This makes it possible for unauthenticated attackers to upload arbitrary files that make remote...