Lagom
Monthly
PHP object injection in the Themeton Lagom WordPress theme (versions up to and including 2.0) allows remote attackers to trigger unsafe deserialization of attacker-controlled data, potentially leading to full site compromise. The flaw is reported by Patchstack and carries a critical CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N); no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Denial of service in Lagom WHMCS Template through version 2.4.2 allows authenticated remote attackers to exhaust server resources via manipulation of the Datatables component, resulting in application unavailability. Publicly available exploit code exists and the vendor has not responded to early disclosure notification. CVSS 4.3 reflects moderate severity with low attack complexity requiring authenticated access.
A vulnerability was found in Lagom WHMCS Template up to 2.3.7.
An issue in zuoxingdong lagom v.0.1.2 allows a local attacker to execute arbitrary code via the pickle_load function of the serialize.py file. Rated medium severity (CVSS 6.6), this vulnerability is low attack complexity. No vendor patch available.
PHP object injection in the Themeton Lagom WordPress theme (versions up to and including 2.0) allows remote attackers to trigger unsafe deserialization of attacker-controlled data, potentially leading to full site compromise. The flaw is reported by Patchstack and carries a critical CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N); no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Denial of service in Lagom WHMCS Template through version 2.4.2 allows authenticated remote attackers to exhaust server resources via manipulation of the Datatables component, resulting in application unavailability. Publicly available exploit code exists and the vendor has not responded to early disclosure notification. CVSS 4.3 reflects moderate severity with low attack complexity requiring authenticated access.
A vulnerability was found in Lagom WHMCS Template up to 2.3.7.
An issue in zuoxingdong lagom v.0.1.2 allows a local attacker to execute arbitrary code via the pickle_load function of the serialize.py file. Rated medium severity (CVSS 6.6), this vulnerability is low attack complexity. No vendor patch available.