Tag
YesWiki PHP Object Injection Vulnerability (CVE-2026-52777)
1 rule 4 TTPsAn authenticated PHP Object Injection vulnerability (CVE-2026-52777) in YesWiki's `BazarImportAction`, specifically within the `unserialize` function, allows remote code execution (RCE) on the YesWiki server when an authenticated administrator's browser is targeted via a cross-site request forgery (CSRF) attack.
JoomShaper SP LMS PHP Object Injection Leads to RCE (CVE-2026-48909)
1 rule 3 TTPs 1 CVEA critical PHP object injection vulnerability (CVE-2026-48909) in JoomShaper SP LMS versions <= 4.1.3 allows unauthenticated attackers to achieve remote code execution (RCE) via a crafted 'lmsOrders' cookie, leading to webshell deployment on vulnerable Joomla installations (< 5.2.2).
MetaSlider Responsive Slider Plugin Deserialization Vulnerability (CVE-2026-39467)
2 rules 1 TTP 1 CVEA deserialization of untrusted data vulnerability in the MetaSlider Responsive Slider plugin for WordPress (versions up to 3.106.0) allows for unauthenticated object injection, potentially leading to remote code execution.
Smart Post Show WordPress Plugin PHP Object Injection Vulnerability
2 rules 1 TTP 1 CVEThe Smart Post Show WordPress plugin versions 3.0.12 and earlier are vulnerable to PHP Object Injection via deserialization of untrusted input in the import_shortcodes() function, potentially leading to remote code execution if a suitable POP chain is present.
Everest Forms WordPress Plugin PHP Object Injection Vulnerability
2 rules 2 TTPs 1 CVEThe Everest Forms plugin for WordPress is vulnerable to PHP Object Injection (CVE-2026-3296) in versions up to 3.4.3, allowing unauthenticated attackers to execute arbitrary code by injecting serialized PHP objects via form fields.