EUVD-2026-39695
GHSA-c9rr-c93m-9hvh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (patchstack) · only source for this CVE.
CVSS VectorVendor: patchstack
Lifecycle Timeline
1DescriptionCVE.org
Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions.
Articles & Coverage 2
AnalysisAI
PHP Object Injection in the BuddyBoss Platform WordPress plugin (versions 3.0.4 and earlier) allows attackers with low-privilege Subscriber access to inject crafted serialized objects that are deserialized unsafely, potentially leading to remote code execution, data tampering, or denial of service depending on available gadget chains. The flaw was reported by Patchstack and carries a CVSS base score of 9.8; however, the 'Subscriber' qualifier implies authenticated access is required, which conflicts with the PR:N in the published vector. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today