PULSEUnderground Intel

EN VIVO15señales / 24h

FEED

ransompanzer reclama a SweetRush · US · Professional Servicesransomincransom reclama a magnals.com · US · Otherransomdeadlock reclama a Greggio Argento · IT · Agriculture and Food Productionransomeverest reclama a Agri Industrial · Agriculture and Food Productionransomeverest reclama a B-accountants · NL · Professional Servicesransomeverest reclama a Morcon Developments · Otherransomeverest reclama a Kennametal · US · Manufacturingransomeverest reclama a Flydubai · AE · Transportationransomumbra reclama a Four Hands LLC · US · Otherransomakira reclama a Michael K Shelby, CPA · Professional Servicesransomakira reclama a Hygrade · US · Agriculture and Food Productionransomqilin reclama a CORBY ROCK MILL · IE · Manufacturingransomqilin reclama a Delta Marine · FI · Transportationransomqilin reclama a J&D Financial · Financial Servicesransompanzer reclama a SweetRush · US · Professional Servicesransomincransom reclama a magnals.com · US · Otherransomdeadlock reclama a Greggio Argento · IT · Agriculture and Food Productionransomeverest reclama a Agri Industrial · Agriculture and Food Productionransomeverest reclama a B-accountants · NL · Professional Servicesransomeverest reclama a Morcon Developments · Otherransomeverest reclama a Kennametal · US · Manufacturingransomeverest reclama a Flydubai · AE · Transportationransomumbra reclama a Four Hands LLC · US · Otherransomakira reclama a Michael K Shelby, CPA · Professional Servicesransomakira reclama a Hygrade · US · Agriculture and Food Productionransomqilin reclama a CORBY ROCK MILL · IE · Manufacturingransomqilin reclama a Delta Marine · FI · Transportationransomqilin reclama a J&D Financial · Financial Services

← Todos los CVEs

CVE Watch6 oct 2026

CVE-2026-39797

Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.

CVSS

9.8

Crítico

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 6 oct 2026 · Última mod.: 6 oct 2026 · CWE-502

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.

Referencias oficiales

patchstack.comhttps://patchstack.com/database/wordpress/plugin/gdpr-framework/vulnerability/wordpress-gdpr-framework-by-data443-plugin-2-5-0-php-object-injection-vulnerability?_s_id=cve

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-103831—

———CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize() function without restrictions on the classes allowed when retrieving data stored in the cache. An attacker who already has the ability to write manipulated data to the cache backend used by Magento—such as Redis or Memcached—could inject specially crafted PHP objects and trigger their deserialization, potentially leading to arbitrary code execution via gadget strings available in the application environment. Exploitation therefore requires a prerequisite condition that allows writing to the cache infrastructure, either through access to the local file system or to a cache infrastructure accessible from the Magento environment.10h CVE-2026-1047478.1 ALT

———Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.10h CVE-2026-829887.5 ALT

——0There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated download endpoint10h CVE-2026-972578.8 ALT

——0Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7.10h CVE-2026-936177.2 ALT

——0Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1.10h CVE-2026-1033487.2 ALT

——0Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0.10h