php:php-fuzz-unserialize: Stack-use-after-return in zval_get_type

Detailed Report: https://oss-fuzz.com/testcase?key=4532420363812864 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-unserialize Job Type: libfuzzerasanphp Platform Id: linux Crash Type: Stack-use-after-return READ 1 Crash Address: 0x7f3a73cf7308 Crash State: zvalgettype...

CVE-2020-26165

qdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps/qdPM/modules/timeReport/actions/actions.class.php because unserialize is used...

CVE-2020-26165

CVE-2020-26165 affects qdPM through v9.1, where PHP object injection is possible via timeReportActions::executeExport due to using unserialize on user-supplied input. This vulnerability stems from unserialize on the export parameter, enabling injection attacks that can lead to code execution or o...

PT-2020-16322

Name of the Vulnerable Software and Affected Versions qdPM versions 9.1 and earlier Description The issue allows PHP Object Injection via the timeReportActions::executeExport function in core/apps/qdPM/modules/timeReport/actions/actions.class.php because unserialize is used. This can be exploited...

CVE-2020-26165: Deserialization of Untrusted Data

qdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps/qdPM/modules/timeReport/actions/actions.class.php because unserialize is used...

CVE-2020-28339

The usc-e-shop aka Collne Welcart e-Commerce plugin before 1.9.36 for WordPress allows Object Injection because of uscesunserialize. There is not a complete POP chain...

PT-2020-16982

Name of the Vulnerable Software and Affected Versions usc-e-shop aka Collne Welcart e-Commerce plugin versions prior to 1.9.36 for WordPress Description The issue allows Object Injection due to usces unserialize. There is no complete POP chain. Recommendations For versions prior to 1.9.36, update...

PT-2021-18240

Name of the Vulnerable Software and Affected Versions: Requests versions 1.6.0 through 1.7.0 Description: The issue concerns the mishandling of deserialization in FilteredIterator. This allows for the unserialization of untrusted data. Recommendations: For versions 1.6.0, 1.6.1, and 1.7.0, update...

CVE-2020-15148

Yii 2 yiisoft/yii2 before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory...

Remote code execution

Yii 2 yiisoft/yii2 before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory...

CVE-2020-15148 Unsafe deserialization in Yii 2

Yii 2 yiisoft/yii2 before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory...

CVE-2020-15148

CVE-2020-15148 – Yii 2 (

CVE-2020-15148

Yii 2 yiisoft/yii2 before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory...

PT-2020-5121

Name of the Vulnerable Software and Affected Versions Yii 2 yiisoft/yii2 versions prior to 2.0.38 Description The issue is related to the restoration of untrusted data structures in memory, potentially allowing a remote attacker to execute arbitrary code. This can occur if the application calls...

CVE-2020-15148: Deserialization of Untrusted Data

Yii 2 yiisoft/yii2 before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory...

Possible remote code execution via unserialize() on user input containing specially crafted string

More info at https://www.yiiframework.com/news/303/yii-2-0-38...

vBulletin 5.1.2 < 5.1.9 - Unserialize Code Execution Exploit

Exploit for php platform in category web applications This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'vBulletin 5.1.2 Unserialize Code Execution', 'Description' = %q This module exploits a PHP...

Newsletter < 6.8.2 - Authenticated PHP Object Injection

The ‘restoreoptionsfromrequest‘ function called by the AJAX function ‘tnpcrendercallback‘ runs ‘unserialize’ directly on ‘$options'inlineedits'’ which is provided by user input in the $POST‘options’ parameter. This creates the potential for an Object Injection vulnerability. For example, a user...

Exploit for CVE-2015-0273

phpcodz Php Codz Hacking http://www.80vul.com/pch/ What is PHP? PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. If you are new to PHP and want to get some idea of how it works, try the introductory tutorial. Afte...

SquirrelMail <= 1.4.22 Multiple Vulnerabilities

SquirrelMail is prone to multiple Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it...