All CVEs — page 1085 of 1220
The complete archive, 25 per page, newest first. 30483 records. Search instead.
The wpForo Forum plugin has a PHP Object Injection vulnerability that allows authenticated users to inject arbitrary PHP objects during deserialization of profile field values. This can lead to remote code execution or other malicious actions when combined with other plugins or existing POP chains.
The vulnerability allows for out-of-bounds write due to improper handling of the peer_hostname argument, which could lead to remote code execution or other severe impacts.
The flaw allows an unauthenticated attacker to forge a valid session token by exploiting the default empty JWT signing secret, leading to unauthorized access.