CVE Vulnerability Catalog

Picklescan versions before 0.0.33 fail to block the ctypes module, allowing attackers to achieve remote code execution by invoking direct syscalls and accessing raw memory. Attackers can craft malicious pickle files using ctypes.WinDLL to load kernel32.dll and execute arbitrary commands.

Picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist. Attackers can construct malicious pickle objects to overwrite critical system files.

Picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using these unblocked functions to achieve arbitrary code execution when the pickle is deserialized.

The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user.

SQL Injection vulnerability in the Motors (motors-car-dealership-classified-listings) plugin by StylemixThemes allows an attacker to perform blind SQL injection. The issue affects versions from n/a through 1.4.109.

A remote code execution vulnerability in Python StateMachine versions 3.0.0 before 3.2.0 allows attackers to execute arbitrary code by supplying malicious SCXML documents with crafted `<data expr="...">` attributes evaluated unsafely. The flaw enables arbitrary code execution in the context of the hosting process.

CVE-2026-54819 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in Webilia Inc.'s Listdom application.

CVE-2026-54815 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in the Cargo Shipping Location plugin for WooCommerce.

CVE-2026-54809 describes an improper neutralization of special elements used in SQL commands, allowing for Blind SQL Injection in the VillaTheme GIFT4U application.

CVE-2026-54808 describes an improper neutralization of special elements used in SQL commands, allowing for Blind SQL Injection in WP Travel Gutenberg Blocks.

A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping, allowing manipulation of the DN structure used for LDAP bind authentication.

Moderno versions below 1.43 are vulnerable to unauthenticated PHP object injection.

Plumbing versions up to 1.6 are vulnerable to unauthenticated PHP object injection, potentially allowing unauthorized access to the system.

There is an unauthenticated PHP Object Injection vulnerability in Reisen versions <= 1.4.1.

Deserialization of Untrusted Data vulnerability in EMV Creatify allows Object Injection. This issue affects Creatify: from n/a through 1.5.

CVE-2025-60231 describes a deserialization of untrusted data vulnerability in EMV The Hospital, allowing for object injection.

Deserialization of Untrusted Data vulnerability in Themeton The Barber Shop allows Object Injection. This issue affects The Barber Shop from n/a through 1.9.

CVE-2025-60229 is a vulnerability related to the deserialization of untrusted data in Themeton Lagom, allowing for object injection. This issue affects Lagom versions from n/a through 2.0.

There is an unauthenticated SQL injection vulnerability in Advanced Ads – Tracking versions below 3.0.7.

There is an unauthenticated SQL Injection vulnerability in WP eMember versions below 10.9.4.