Base de CVEs

CVE-2026-27379 Alta · 8.8 CWE-502 05/03/2026

WordPress NextScripts plugin <= 4.4.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in NextScripts NextScripts social-networks-auto-poster-facebook-twitter-g allows Object Injection.This issue affects NextScripts: from n/a through <= 4.4.7.

CVE-2026-27369 Alta · 8.1 CWE-502 05/03/2026

WordPress Celeste theme <= 1.3.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in BoldThemes Celeste celeste allows Object Injection.This issue affects Celeste: from n/a through <= 1.3.6.

CVE-2026-27338 Alta · 8.8 CWE-502 05/03/2026

WordPress Car Zone theme <= 3.7 - Deserialization of untrusted data vulnerability

Deserialization of Untrusted Data vulnerability in AivahThemes Car Zone carzone allows Object Injection.This issue affects Car Zone: from n/a through <= 3.7.

CVE-2026-27098 Alta · 8.1 CWE-502 05/03/2026

WordPress Au Pair Agency - Babysitting & Nanny Theme theme <= 1.2.2 - Deserialization of untrusted data vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes Au Pair Agency - Babysitting & Nanny Theme au-pair-agency allows Object Injection.This issue affects Au Pair Agency - Babysitting & Nanny Theme: from n/a through <= 1.2.2.

CVE-2026-24385 Alta · 7.5 CWE-502 05/03/2026

WordPress Podlove Web Player plugin <= 5.9.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in gerritvanaaken Podlove Web Player podlove-web-player allows Object Injection.This issue affects Podlove Web Player: from n/a through <= 5.9.1.

CVE-2026-23798 Alta · 8.8 CWE-502 05/03/2026

WordPress PowerPress Podcasting plugin <= 11.15.10 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in blubrry PowerPress Podcasting powerpress allows Object Injection.This issue affects PowerPress Podcasting: from n/a through <= 11.15.10.

CVE-2026-22501 Crítica · 9.8 CWE-502 05/03/2026

WordPress Mounthood theme <= 1.3.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes Mounthood mounthood allows Object Injection.This issue affects Mounthood: from n/a through <= 1.3.2.

CVE-2026-22497 Crítica · 9.8 CWE-502 05/03/2026

WordPress Jardi theme <= 1.7.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in AncoraThemes Jardi jardi allows Object Injection.This issue affects Jardi: from n/a through <= 1.7.2.

CVE-2026-22475 Crítica · 9.8 CWE-502 05/03/2026

WordPress Estate theme <= 1.3.4 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes Estate estate allows Object Injection.This issue affects Estate: from n/a through <= 1.3.4.

CVE-2026-22474 Crítica · 9.8 CWE-502 05/03/2026

WordPress Equestrian Centre theme <= 1.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Equestrian Centre equestrian-centre allows Object Injection.This issue affects Equestrian Centre: from n/a through <= 1.5.

CVE-2026-22473 Alta · 8.8 CWE-502 05/03/2026

WordPress Dental Clinic theme <= 3.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in designthemes Dental Clinic dental allows Object Injection.This issue affects Dental Clinic: from n/a through <= 3.7.

CVE-2026-22471 Alta · 8.8 CWE-502 05/03/2026

WordPress Secudeal Payments for Ecommerce plugin <= 1.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in maximsecudeal Secudeal Payments for Ecommerce secudeal-payments-for-ecommerce allows Object Injection.This issue affects Secudeal Payments for Ecommerce: from n/a through <= 1.1.

CVE-2026-22454 Crítica · 9.8 CWE-502 05/03/2026

WordPress Solaris theme <= 2.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Solaris solaris allows Object Injection.This issue affects Solaris: from n/a through <= 2.5.

CVE-2026-22453 Crítica · 9.8 CWE-502 05/03/2026

WordPress Pets Club theme <= 2.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Pets Club petclub allows Object Injection.This issue affects Pets Club: from n/a through <= 2.3.

CVE-2026-22451 Crítica · 9.8 CWE-502 05/03/2026

Tema WordPress Handyman - Injeção de Objeto PHP até 1.4.7

Vulnerabilidade de desserialização de dados não confiáveis na AncoraThemes Handyman handyman-services permite injeção de objeto.Este problema afeta Handyman: de n/a até ≤ 1.4.7.

CVE-2026-22417 Crítica · 9.8 CWE-502 05/03/2026

WordPress Grand Wedding theme < 3.1.11 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Wedding grandwedding allows Object Injection.This issue affects Grand Wedding: from n/a through < 3.1.11.

CVE-2025-54001 Crítica · 9.8 CWE-502 05/03/2026

Tema WordPress Classter - Injeção de Objeto PHP

Vulnerabilidade de Deserialização de Dados Não Confiáveis no ThemeREX Classter classter permite Object Injection.Este problema afeta Classter: de n/a até <= 2.5.

CVE-2026-20131 Crítica · 10.0 KEV Urgente · 79 Exploit público Ransomware CWE-502 04/03/2026

Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.

CVE-2026-3452 Alta · 7.2 CWE-502 03/03/2026

Concrete CMS below 9.4.8 is vulnerable to stored deserialization leading to RCE in the Express Entry List block.

Concrete CMS below version 9.4.8 is vulnerable to Remote Code Execution by stored PHP object injection into the Express Entry List block via the columns parameter. An authenticated administrator can store attacker-controlled serialized data in block configuration fields that are later passed to unserialize() without class restrictions or integrity checks. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.9 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Thanks YJK ( @YJK0805 https://hackerone.com/yjk0805 ) of ZUSO ART https://zuso.ai/ for reporting.

CVE-2026-27971 Crítica · 9.8 Exploit público CWE-502 03/03/2026

Qwik: RCE não autenticado por desserialização insegura em server$

Qwik é um framework JavaScript focado em desempenho. O qwik na versão <=1.19.0 é vulnerável a RCE devido a uma desserialização insegura no mecanismo RPC server$ que permite que qualquer usuário não autenticado execute código arbitrário no servidor com uma única requisição HTTP. Afeta qualquer implantação em que require() esteja disponível em tempo de execução. Esta vulnerabilidade está corrigida na versão 1.19.1.

CVE-2025-57622 Crítica · 9.8 CWE-502 03/03/2026

An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the…

An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loads(request.get_data()) component

CVE-2025-52998 Crítica · 9.8 CWE-502 02/03/2026

Chamilo: PHAR deserialization bypass

Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modify the logic of the web application's operation. This issue has been patched in version 1.11.30.

CVE-2025-50198 Média · 4.9 CWE-502 02/03/2026

Chamilo: Deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parameters

Chamilo is a learning management system. Prior to version 1.11.30, Chamilo is vulnerable to deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parameters. This issue has been patched in version 1.11.30.

CVE-2024-47886 Alta · 7.2 CWE-502 02/03/2026

Chamilo: Post-Auth Remote Code Execution

Chamilo is a learning management system. Chamillo is affected by a post-authentication phar unserialize which leads to a remote code execution (RCE) within versions 1.11.12 to 1.11.26. By abusing multiple supported features from the virtualization plugin vchamilo, the vulnerability allows an administrator to execute arbitrary code on the server. This issue has been patched in version 1.11.26.

CVE-2026-3422 Crítica · 9.8 CWE-502 02/03/2026

e-Excellence｜U-Office Force - Insecure Deserialization

U-Office Force developed by e-Excellence has a Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized content.