CVE Vulnerability Catalog

PHP Object Injection vulnerability in the Education Center theme in versions up to and including 3.6.12. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The vulnerability stems from a lack of input validation.

PHP Object Injection vulnerability in the Drone Media theme in versions up to and including 2.2.0. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The vulnerability stems from a lack of input validation.

Arbitrary file upload vulnerability allowing a Contributor user to upload arbitrary files in the Creator LMS plugin in versions up to and including 1.2.21. A low-privileged user can upload arbitrary files to the server. This may lead to malicious code execution.

PHP Object Injection vulnerability in the Asia Garden theme in versions up to and including 1.3.1. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The vulnerability stems from a lack of input validation.

PHP Object Injection vulnerability in the N7 | Golf Club Sports & Events theme in versions up to and including 2.21. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The vulnerability stems from a lack of input validation.

PHP Object Injection vulnerability in the Invetex theme in versions up to and including 2.18. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The vulnerability stems from a lack of input validation.

PHP Object Injection vulnerability in the Law Office theme in versions up to and including 3.20. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The vulnerability stems from a lack of input validation.

PHP Object Injection vulnerability in the WineShop theme in versions up to and including 3.20. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The vulnerability stems from a lack of input validation.

PHP Object Injection vulnerability in the Equadio theme in versions up to and including 1.1.4. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The vulnerability stems from a lack of input validation.

PHP Object Injection vulnerability in Juno versions up to and including 2.25. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The issue affects unauthenticated access.

PHP Object Injection vulnerability in Avala versions up to and including 1.1.4. An unauthenticated attacker can inject a malicious PHP object. This may lead to further exploitation of the system.

PHP Object Injection vulnerability in Kalles versions up to and including 1.1.7.1. An unauthenticated attacker can inject a malicious PHP object. This may lead to further exploitation of the system.

PHP Object Injection vulnerability in Yacht Rental versions up to and including 2.6. An unauthenticated attacker can inject a malicious PHP object. This may lead to further exploitation of the system.

PHP Object Injection vulnerability in Wine House versions up to and including 3.20. An unauthenticated attacker can inject a malicious PHP object. This may lead to further exploitation of the system.

PHP Object Injection vulnerability in Tipsy versions up to and including 1.6. An unauthenticated attacker can inject a malicious PHP object. This may lead to further exploitation of the system.

PHP Object Injection vulnerability in Stargaze versions up to and including 1.10. An unauthenticated attacker can inject a malicious PHP object. This may lead to further exploitation of the system.

PHP Object Injection vulnerability in Splendour versions up to and including 1.23. An unauthenticated attacker can inject a malicious PHP object. This may lead to further exploitation of the system.

Local File Inclusion vulnerability in DirectoryPress versions up to and including 3.6.27. An unauthenticated attacker can include local files, potentially leading to information disclosure or code execution. The issue affects unauthenticated access.

SQL Injection vulnerability in uListing versions up to and including 2.2.0. An unauthenticated attacker can inject malicious SQL queries, potentially leading to disclosure or modification of database data. The issue affects unauthenticated access.

The Tailored Tools plugin in versions up to and including 3.0.3 contains an unauthenticated arbitrary file upload vulnerability. The lack of required authorization allows exploitation without an account in the application.