CVE-2026-3296

CVE-2026-3296 CVE-2026-3296 é uma vulnerabilidade CVSS 9.8 Crítica de Injeção de Objetos PHP não autenticada no plugin Everest Forms WordPress. CVE-2026-3296 — Everest Forms Scanner de Injeção de Objetos PHP Plugin: Everest Forms – Formulário de Contato, Formulário de Pagamento, Quiz, Pesquisa e...

PHP-binary-bugs

Exploits AI POP Builder एडवाइज़री PHP बाइनरी बग्स की एडवाइज़री का संग्रह unserialize में अनफिक्स्ड GMP टाइप कन्फ्यूज़न विचार: विलंबित wakeup को बायपास करें और PHP = 5.6.40 में अनफिक्स्ड GMP टाइप कन्फ्यूज़न बग का शोषण करें। POC स्रोत: GMPtypeconfPOC.php एडवाइज़री CVE-2022-31626 विश्लेषण विचार:...

Node.js-CVE-2017-5941

عرض توضيحي لثغرة إزالة التسلسل غير الآمنة في NodeJS Node.js هي بيئة تشغيل مفتوحة المصدر تُستخدم لتنفيذ وظائف الخادم بلغة JavaScript. تحتوي حزمة برمجية محددة داخل Node.js على دالة ضعيفة تتعامل مع إزالة التسلسل، مما يؤدي إلى تنفيذ أوامر غير مصرح بها إذا قدم العميل ملف تعريف ارتباط مصنوعًا خصيصًا. ت...

CVE-2026-2898-FunAdmin-Deserialization

CVE-2026-2898 - Desserialização Insegura no FunAdmin Resumo O FunAdmin Aviso Legal Apenas para fins educacionais e testes autorizados...

CVE-2018-15133-laravel-framework

CVE-2018-15133 - Laboratoire vulnérable Laravel Framework 5.6.x Ce dépôt fournit un laboratoire Docker reproductible pour CVE-2018-15133 RCE par désérialisation du token Laravel lorsque APPKEY est connu. L'application est épinglée à une version vulnérable de Laravel 5.6.x et expose une simple rou...

CVE-2026-77138

The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server...

CVE-2026-56095

The extension's indexer passed every field value returned by content object rendering through PHP's unserialize function when transferring multi-value data for the SOLRCLASSIFICATION, SOLRMULTIVALUE and SOLRRELATION content object types, rather than a safe format. If user-generated content saved ...

EUVD-2026-65350

The extension's indexer passed every field value returned by content object rendering through PHP's unserialize function when transferring multi-value data for the SOLRCLASSIFICATION, SOLRMULTIVALUE and SOLRRELATION content object types, rather than a safe format. If user-generated content saved ...

CVE-2026-56095

The Apache Solr for TYPO3 – Enterprise Search (solr) extension is affected by an insecure deserialization flaw in its indexer. When transferring multi-value data for the SOLR_CLASSIFICATION , SOLR_MULTIVALUE , and SOLR_RELATION content object types, every field value returned by content object re...

CVE-2026-56095 Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

The extension's indexer passed every field value returned by content object rendering through PHP's unserialize function when transferring multi-value data for the SOLRCLASSIFICATION, SOLRMULTIVALUE and SOLRRELATION content object types, rather than a safe format. If user-generated content saved ...

CVE-2026-77138

CVE-2026-77138 affects the TYPO3 extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail) . The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safe processing, enabling PHP Object Injection . A remote, unauthenticated attacker can supply a ...

CVE-2026-77138 Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)

The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server...

exploit_laravel_cve-2018-15133

ثغرة Laravel لـ CVE-2018-15133 يستغل هذا الكود CVE-2018-15133 وهو مبني على برهان المفهوم لـ kosmiz و استغلال Metasploit لهذه الثغرة. لقد قمت بهذا بشكل أساسي لجهاز في Hack The Box، لأنني لم أرغب في استخدام Metasploit في تلك اللحظة وكذريعة لتعلم Python. من وصف CVE: في إطار Laravel حتى الإصدار 5.5.4...

RCE-NodeJs

node-serialize — CVE-2017-5941 Nota: Este documento é apenas para fins de defesa e educacionais. Não há instruções sobre como criar exploits ou RCE. Resumo: node-serialize 0.0.4 e versões desatualizadas semelhantes pode representar risco devido à desserialização não confiável — sempre valide os...

Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection

The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize on stored entry meta...

Yii 2 < 2.0.38 - Remote Code Execution

Yii 2 yiisoft/yii2 before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize on arbitrary user input. id: CVE-2020-15148 info: name: Yii 2 2.0.38 - Remote Code Execution author: pikpikcu severity: critical description: Yii 2 yiisoft/yii2 before version 2.0....

Revive Adserver 4.2 - Remote Code Execution

Revive Adserver 4.2 is susceptible to remote code execution. An attacker can send a crafted payload to the XML-RPC invocation script and trigger the unserialize call on the "what" parameter in the "openads.spc" RPC method. This can be exploited to perform various types of attacks, e.g...

day06-foxcms-rce

Dia06 — RCE estilo FoxCMS CVE-2025-29306 — Laboratório educacional Este pequeno laboratório simula a ideia central por trás de CVE-2025-29306 : uso inseguro de unserialize em entrada controlada pelo atacante, levando à execução remota de código. Esta é uma réplica educacional mínima e...

phpggc

PHPGGC: سلاسل الأدوات العامة لـ PHP PHPGGC هي مكتبة من حمولاتunserialize بالإضافة إلى أداة لتوليدها، من سطر الأوامر أو برمجيًا. عند مواجهة unserialize على موقع لا تملك كوده، أو ببساطة عند محاولة بناء استغلال، تتيح لك هذه الأداة توليد الحمولة دون الحاجة إلى المرور بالخطوات المملة للعثور على الأدوا...

CVE-2024-12877-Exploit

GO-TO CVE – CVE-2024-12877-Exploit सप्ताह 66 | लेखक: Ali Soltani soltanali0 GO-TO CVE श्रृंखला के सप्ताह 66 में आपका स्वागत है, जहाँ हम कमजोरियों का विश्लेषण करते हैं, मूल कारणों की जाँच करते हैं, और एक सुरक्षित, शैक्षिक संदर्भ में व्यावहारिक शोषण तकनीकों का प्रदर्शन करते हैं। 🚨 अवलोकन...