| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `public/main/cron/import_csv.php` call PHP's native `unserialize()` on `user_career.extra_data` retrieved from the database without the `allowed_classes: false` safety option. An attacker able to write crafted serialized PHP objects to that column, for example through a separate SQL injection, a compromised admin CSV import, or a lower-privilege admin panel, can instantiate arbitrary PHP objects and trigger POP gadget chains in autoloaded `Symfony`, `Doctrine`, or `Monolog` components. This permits arbitrary OS commands as the web server user, compromising server confidentiality, integrity, and availability. This issue is fixed in version 2.0.1. |
| InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized_named_tensors, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process. |
| The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a routine media replacement, resulting in PHP Object Injection and local file inclusion of existing PHP/HTML files, which can be escalated to remote code execution where an attacker-influenced PHP or HTML file is present on the server.
This is a regression of CVE-2023-4643, which was fixed in 4.1.3 and reintroduced in 4.1.4. |
| Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions. |
| Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions. |
| Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions. |
| Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions. |
| Unauthenticated PHP Object Injection in Preservation <= 1.15 versions. |
| Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions. |
| Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions. |
| Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions. |
| Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. |
| Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions. |
| Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions. |
| Unauthenticated PHP Object Injection in Nuts <= 1.12 versions. |
| Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions. |
| Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas._generate_tables via pandas.read_pickle() without validation, so when a victim calls datasets.load_dataset("pandas", data_files=...), the embedded __reduce__ payload executes code with the victim process's privileges. |
| Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions. |
| Contributor PHP Object Injection in Social Snap <= 1.5.4 versions. |
| Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions. |
