https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 15:16:25 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-98747 EUVD-2026-98747 https://cve.radiocsirt.org/vuln/euvd-2026-98747 https://cve.radiocsirt.org/vuln/fkie_cve-2014-2921 <p>The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a Zend_Pdf_ElementFactory_Proxy object and a pathname with a trailing \0 character.</p> <p>The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a Zend_Pdf_ElementFactory_Proxy object and a pathname with a trailing \0 character.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2014-2921 https://cve.radiocsirt.org/vuln/ghsa-g7pj-3v97-3vxp <p><strong>Affected:</strong> Packagist: pimcore/pimcore</p> <p>The `getObjectByToken` function in `Newsletter.php` in the `Pimcore_Tool_Newsletter` module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a `Zend_Pdf_ElementFactory_Proxy` object and a pathname with a trailing `\0` character.</p> <p><strong>Affected:</strong> Packagist: pimcore/pimcore</p> <p>The `getObjectByToken` function in `Newsletter.php` in the `Pimcore_Tool_Newsletter` module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a `Zend_Pdf_ElementFactory_Proxy` object and a pathname with a trailing `\0` character.</p> https://cve.radiocsirt.org/vuln/ghsa-g7pj-3v97-3vxp https://cve.radiocsirt.org/vuln/gsd-2014-2921 gsd-2014-2921 https://cve.radiocsirt.org/vuln/gsd-2014-2921