[{"data":1,"prerenderedAt":42},["ShallowReactive",2],{"sicherheitsluecke-cve-2026-119077":3},{"l":4,"details":22,"weitere":25,"indexierbar":40,"updated":41},{"cve":5,"status":6,"vendor":7,"product":8,"name":7,"added":9,"due":7,"ransomware":10,"published":9,"cwes":11,"cvss":13,"slug":18,"bereich":19,"schweregrad":20,"art":21,"produktLabel":8},"CVE-2026-119077","gemeldet","","ELEX WordPress HelpDesk & Customer Ticketing Syste (WordPress-Plugin)","2026-11-13",false,[12],"CWE-502",{"version":14,"score":15,"severity":16,"vector":17},"3.1",9.8,"CRITICAL","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H","cve-2026-119077","web","kritisch","Unsicheres Einlesen von Daten (Deserialisierung)",{"description":23,"refs":24},"The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form string)' parameter parameter. This is due to missing server-side authentication and the absence of a class allowlist on deserialization, with the only guard being a nonce publicly emitted on any page carrying the [wsdesk_support] shortcode. This makes it possible for unauthenticated attackers to execute code on the server. A successful exploit requires a single anonymous GET to any public page carrying the [wsdesk_support] shortcode to harvest the publicly emitted wsdesk_nonce value, after which a single unauthenticated POST completes the attack.",[],[26,30,35],{"cve":27,"status":6,"produktLabel":28,"vendor":7,"product":28,"art":29,"bereich":19,"schweregrad":20,"score":15,"epss":-1,"added":9,"ransomware":10},"CVE-2026-125055","Chatterbug Forms (WordPress-Plugin)","Hochladen gefährlicher Dateien",{"cve":31,"status":6,"produktLabel":32,"vendor":7,"product":32,"art":33,"bereich":19,"schweregrad":20,"score":34,"epss":-1,"added":9,"ransomware":10},"CVE-2026-128049","OpenMage Magento LTS","Untergeschobene Anfragen (Cross-Site Request Forgery)",9.4,{"cve":36,"status":6,"produktLabel":37,"vendor":7,"product":37,"art":38,"bereich":19,"schweregrad":20,"score":39,"epss":-1,"added":9,"ransomware":10},"CVE-2026-126473","OpenEMR","Fehlerhafte Berechtigungsprüfung",9.3,true,"2026-11-13T12:30:14.259Z",1794573100148]