All CVEs — page 720 of 854
The complete archive, 25 per page, newest first. 21350 records. Search instead.
The wpForo Forum plugin has a PHP Object Injection vulnerability that allows authenticated users to inject arbitrary PHP objects during deserialization of profile field values. This can lead to remote code execution or other malicious actions when combined with other plugins or existing POP chains.
The vulnerability allows for out-of-bounds write due to improper handling of the peer_hostname argument, which could lead to remote code execution or other severe impacts.
The flaw allows an unauthenticated attacker to forge a valid session token by exploiting the default empty JWT signing secret, leading to unauthorized access.
The flaw allows unauthenticated attackers to escalate privileges by exploiting a vulnerability in the Paytium: Mollie plugin, enabling them to register a new administrator account and take full control of the site.