Search CVEs

Saloon is a PHP library that gives users tools to build API integrations and SDKs. Versions prior to 4.0.0 used PHP's unserialize() in AccessTokenAuthenticator::unserialize() to restore OAuth token st

Saloon is a PHP library that gives users tools to build API integrations and SDKs. Prior to version 4.0.0, when building the request URL, Saloon combined the connector's base URL with the request endp

Unauthenticated PHP Object Injection in Reina <= 2.1 versions.

Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions.

Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a

The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to tr

The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP obje

Zumba Json Serializer is a library to serialize PHP variables in JSON format. In versions 3.2.2 and below, the library allows deserialization of PHP objects from JSON using a special @type field. The

Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction. An unauthenticate

Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the  in Permission, Cache, and Search components. An unauthenticated attacker may trigger arbitrary PHP object

Unauthenticated PHP Object Injection in Kapee < 1.7.0 versions.

Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions.

Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions.

Unauthenticated PHP Object Injection in Valiance <= 1.2 versions.

A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php

Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions.

Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions.

Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions.

Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions.

Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions.