Alertas de Seguridad de la Información

Unauthenticated PHP Object Injection in FreightCo

El plugin WS Form LITE (versiones hasta 1.10.80) para WordPress contiene una vulnerabilidad de inyección de objetos PHP (CVE-2026-4703, CVSS 9.8) que permite a atacantes no autenticados inyectar objetos maliciosos a través de la deserialización de datos en envíos de formularios. Este riesgo afecta directamente a miles de sitios WordPress en México y Latinoamérica que utilizan este constructor de formularios, exponiendo datos sensibles de contacto y potencialmente comprometiendo la integridad del servidor.

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.

Se ha identificado una vulnerabilidad crítica (CVSS 9.8) de inyección de objetos PHP en FundEngine versiones 1.7.9 y anteriores que permite a atacantes no autenticados ejecutar código arbitrario en servidores afectados. Esta vulnerabilidad representa un riesgo severo para plataformas de crowdfunding y gestión de fondos operadas en México y Latinoamérica. Los sistemas expuestos podrían comprometer datos financieros, información de usuarios y la integridad operacional de las aplicaciones.

Unauthenticated PHP Object Injection in Flatastic

Unauthenticated PHP Object Injection in Forminator

LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle_zmq_recv coroutine in lmdeploy/pytorch/disagg/conn/engine_conn.py reads peer-to-peer cache-free requests with recv_pyobj(), which deserializes the received bytes with pickle.loads(), and the isinstance check against DistServeCacheFreeRequest runs only after deserialization has already completed. The peer that supplie…

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored data without checking whether the content is of the expected type.

Unauthenticated PHP Object Injection in Kalles Addons

Customer PHP Object Injection in Flexible Subscriptions

Unauthenticated Deserialization of untrusted data in Youzify

Unauthenticated PHP Object Injection in Popup by Supsystic

Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.

Unauthenticated PHP Object Injection in Easy Google Maps

Unauthenticated PHP Object Injection in RegistrationMagic

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potenti…

Unauthenticated PHP Object Injection in FundEngine