CVE-2019-13292-WebERP_4.15

Blind SQL Injection Exploit for WebERP This is a Python3 script that demonstrates an exploit for a Blind SQL Injection vulnerability in WebERP version 4.15, initially discovered by Semen Alexandrovich Lyhin on June 10, 2019. The original exploit can be found here, and further details regarding th...

cotonti-commentswidget-poc

Cotonti CommentsWidget PHP Object Injection PoC Safe local proof of concept for the PHP object injection issue identified in Cotonti's CommentsWidget implementation. Vulnerability Project: Cotonti Affected component: plugins/comments/inc/CommentsWidget.php CWE: CWE-502 — Deserialization of...

Node.js-CVE-2017-5941

NodeJS Insecure Deserialisation Vulnerability Demo Node.js is an open-source runtime environment used to implement server functionality in JavaScript. A specific software package within Node.js contains a vulnerable function dealing with deserialisation, that causes it to run unauthorised command...

PT-2026-116352

Name of the Vulnerable Software and Affected Versions LearnPress versions prior to 4.4.11 Description An unauthenticated attacker can perform PHP Object Injection by sending untrusted input through the checkout-email request parameter during the checkout AJAX action. The input is processed by...

CVE-2026-110874 Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize in functions.lib.php, which calls unserialize without class restrictions when jsondecode fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized...

CVE-2026-110761 ILIAS before 9.24, 10.12, and 11.5 PHP Object Injection via Test Results Import

ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tstsequence sequence attribute that is passed to...

CVE-2026-55573

e107 is a content management system CMS. Prior to 2.3.7, install.php decodes the attacker-controlled previoussteps POST parameter and passes it to unserialize at file scope and again in the einstall constructor without restricting allowed classes. The installer remains accessible after a normal...

CVE-2026-55573

The e107 content management system (CMS) versions prior to 2.3.7 is vulnerable to unauthenticated remote code execution (RCE) due to unsafe deserialization. The install.php file processes the attacker-controlled previous_steps POST parameter using unserialize() without restricting allowed classes...

EUVD-2026-101532

e107 is a content management system CMS. Prior to 2.3.7, install.php decodes the attacker-controlled previoussteps POST parameter and passes it to unserialize at file scope and again in the einstall constructor without restricting allowed classes. The installer remains accessible after a normal...

CVE-2026-55573 e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain

e107 is a content management system CMS. Prior to 2.3.7, install.php decodes the attacker-controlled previoussteps POST parameter and passes it to unserialize at file scope and again in the einstall constructor without restricting allowed classes. The installer remains accessible after a normal...

exploit_laravel_cve-2018-15133

Exploit de Laravel para CVE-2018-15133 Este código explota CVE-2018-15133 y está basado en el PoC de kosmiz y el exploit de Metasploit para esta vulnerabilidad. Básicamente lo hice para una máquina en Hack The Box, porque no quería usar Metasploit en ese momento y como excusa para practicar Pytho...

PT-2026-109589

Name of the Vulnerable Software and Affected Versions Axiomthemes Balance versions prior to 1.12.1 Description The Axiomthemes Balance WordPress theme contains a flaw where it deserializes untrusted user-controlled data using the unserialize function. This allows for PHP object injection, where...

phpggc

PHPGGC: Catene di Gadget Generici PHP PHPGGC è una libreria di payload unserialize insieme a uno strumento per generarli, da riga di comando o programmaticamente. Quando incontri una unserialize su un sito web di cui non hai il codice, o semplicemente quando cerchi di costruire un exploit, questo...

CVE-2026-103831

CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize function without restrictions on the classes allowed when retrieving data stored in the cache. An attacker who already has the...

CVE-2026-103831 Insecure deserialization in the TrueLayer Magento 2 plugin

CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize function without restrictions on the classes allowed when retrieving data stored in the cache. An attacker who already has the...

CVE-2026-103831 Insecure deserialization in the TrueLayer Magento 2 plugin

CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize function without restrictions on the classes allowed when retrieving data stored in the cache. An attacker who already has the...

Exploit for CVE-2026-104905

CVE-2026-104905 — PHP Object Injection in FacturaScripts Widg...

PT-2026-106707

CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize function without restrictions on the classes allowed when retrieving data stored in the cache. An attacker who already has the...

CVE-2026-104905

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData that allows authenticated attackers to trigger unserialize on raw POST data without an allowedclasses filter for multiple-select fields. Attackers can submit a serialized XLSXWriter...

CVE-2026-104905 FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData that allows authenticated attackers to trigger unserialize on raw POST data without an allowedclasses filter for multiple-select fields. Attackers can submit a serialized XLSXWriter...