Unserialize — PoC Archivehttps://poc.intelseclab.com/tags/unserialize/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000GiveWP Unauthenticated PHP Object Injection via Weak Serialized-Data Regex Check (CVE-2025-22777)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-22777-givewp-php-object-injection/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-22777-givewp-php-object-injection/Critical severity (CVSS 9.8) — web · CVE-2025-22777. Status: PoC. Affects: GiveWP – Donation Plugin and Fundraising Platform (WordPress plugin, 100,000+ active installs). Tags: givewp, wordpress, wordpress-plugin, php-object-injection, deserialization, unserialize, gadget-chain, cwe-502, php, unauthenticated.webCriticalgivewpwordpresswordpress-pluginphp-object-injectiondeserializationunserializegadget-chaincwe-502phpunauthenticatedEverest Forms Unauthenticated PHP Object Injection to RCE (CVE-2026-3296)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3296-everest-forms-object-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3296-everest-forms-object-injection/Critical severity (CVSS 9.8) — web · CVE-2026-3296. Status: PoC (functional two-phase injection/trigger tool; RCE requires supplying a real POP gadget chain via PHPGGC). Affects: Everest Forms (WordPress plugin — Contact Form, Payment Form, Quiz, Survey & Custom Form Builder). Tags: wordpress, everest-forms, php-object-injection, deserialization, unserialize, rce, cwe-502.webCriticalwordpresseverest-formsphp-object-injectiondeserializationunserializercecwe-502