PoC Archive PoC Archive

tag

Php-Object-Injection

  • CVE-2025-22777 web CRITICAL 9.8

    GiveWP Unauthenticated PHP Object Injection via Weak Serialized-Data Regex Check (CVE-2025-22777)

    CVE-2025-22777 is an unauthenticated PHP Object Injection (CWE-502, Deserialization of Untrusted Data) vulnerability in the GiveWP WordPress donation plugin. GiveWP stores certain donor-supplied form field values as serialized PHP meta in the database and…

    Patched 2026-07-06
  • CVE-2026-49105 web HIGH 8.1

    WP Zendesk for Contact Form 7 Unauthenticated PHP Object Injection (CVE-2026-49105)

    This PoC targets the WP Zendesk for Contact Form 7 plugin, whose cf7-zendesk.php calls maybeunserialize() on user-supplied Contact Form 7 field values without validation. An unauthenticated attacker can locate a site's CF7 forms via the CF7 REST API (or by…

    Unverified 2026-07-05
  • CVE-2026-49085 web HIGH 8.1

    WP Insightly Contact Form Plugin Unauthenticated PHP Object Injection (CVE-2026-49085)

    This PoC targets the WP Insightly plugin, which calls PHP's maybeunserialize() on user-supplied form field values without validating the input. An unauthenticated attacker can submit a crafted PHP serialized object as a form field value through the plugin's…

    Unverified 2026-07-05
  • CVE-2026-54806 web CRITICAL 9.8

    WP Activity Log Unauthenticated PHP Object Injection — CVE-2026-54806

    WP Activity Log logs the User-Agent header on any request that generates a loggable event (such as a failed login), and stores that value in the database without treating it as untrusted input. The stored value is later deserialized (via PHP's native…

    Patched 2026-07-05
  • CVE-2026-48909 web CRITICAL 9.5

    SP LMS PHP Object Injection → Unauthenticated RCE (CVE-2026-48909)

    SP LMS's cart model (components/comsplms/models/cart.php) reads the lmsOrders cookie, base64-decodes it, and passes the result directly to PHP's unserialize() with no validation, giving an unauthenticated attacker full control over the deserialized object…

    Patched 2026-07-05
  • CVE-2026-49104 web HIGH 8.1

    Integration for Keap/Infusionsoft Contact Form Plugin Unauthenticated PHP Object Injection (CVE-2026-49104)

    This PoC targets the "Integration for Keap/Infusionsoft" WordPress plugin, whose cf7-infusionsoft.php file calls maybeunserialize() on user-supplied form field values without validation. An unauthenticated attacker can submit a crafted PHP serialized object…

    Unverified 2026-07-05
  • CVE-2026-9691 web HIGH 8.1

    Integration for ActiveCampaign Unauthenticated PHP Object Injection via Unsafe Deserialization (CVE-2026-9691)

    The plugin's cf7-active-campaign.php component calls PHP's maybeunserialize() on user-supplied form field values without validation before forwarding them to ActiveCampaign. An unauthenticated attacker can submit a crafted, serialized PHP object as a form…

    Unpatched 2026-07-05
  • CVE-2026-3296 web CRITICAL 9.8

    Everest Forms Unauthenticated PHP Object Injection to RCE (CVE-2026-3296)

    Everest Forms saves submitted form field values into the wpevfentrymeta table using maybeserialize(), and its sanitization routine (sanitizetextfield()) strips HTML/null bytes but does not strip PHP serialization control characters, so an attacker can submit…

    Patched 2026-07-05
  • CVE-2026-45247 web CRITICAL 9.3 KEV EPSS 28%

    Unauthenticated RCE in Mirasvit Full Page Cache Warmer for Magento 2 (CVE-2026-45247)

    CVE-2026-45247 is a PHP object injection / insecure deserialization vulnerability in Mirasvit's Full Page Cache Warmer extension for Magento 2. The extension processes attacker-controlled data from the CacheWarmer cookie and passes it directly to PHP's native…

    Unverified 2026-07-01