Threat database

CVE-2026-93936 is a critical vulnerability in ThemeREX Group's IPharm product, affecting versions from 0 up to and including 1.2.4. It involves deserialization of untrusted data, which allows object injection. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-93935 is a critical deserialization of untrusted data vulnerability in ThemeREX Group's Let's Play product, affecting versions from 0 up to and including 1.1.15. The flaw allows object injection, which can lead to full compromise of confidentiality, integrity, and availability. The vulnerability has a high CVSS score of 9.8, indicating severe impact if exploited. No official patch or remediation details are provided in the available data.

CVE-2026-93934 is a critical deserialization of untrusted data vulnerability in ThemeREX Group's Partiso product. It allows object injection and affects versions from 0 up to and including 1.1.13. The vulnerability has a high CVSS score of 9.8, indicating it can be exploited remotely without privileges or user interaction, leading to full confidentiality, integrity, and availability compromise.

CVE-2026-93933 is a critical deserialization of untrusted data vulnerability in ThemeREX Group's Rosalinda product, affecting versions up to 1.2.4. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability without requiring user interaction or privileges.

CVE-2026-93932 is a critical vulnerability in ThemeREX Group's Smart Casa product that allows deserialization of untrusted data, leading to object injection. This vulnerability affects versions from 0 up to and including 1.0.12. It has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability without requiring user interaction or privileges.

CVE-2026-93931 is a critical deserialization of untrusted data vulnerability in ThemeREX Group's Smash product. It allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The issue affects Smash versions from initial releases up to and including 1.12.0. The vulnerability has a CVSS score of 9.8, indicating a high severity with network attack vector and no required privileges or user interaction.

CVE-2026-93930 is a critical deserialization of untrusted data vulnerability in ThemeREX Group's Tantra product. It allows object injection and affects Tantra versions from the initial release through 2.9.0. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No patch or remediation information is provided in the available data.

CVE-2026-93929 is a critical deserialization of untrusted data vulnerability in ThemeREX Group's Travesia product. It allows object injection attacks in versions from 0 up to and including 1.1.16. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No patch or remediation information is provided in the available data.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue affects Education Center: from n/a through 3.6.12.

Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.

CVE-2026-65573 is a critical vulnerability in ThemeREX Abelle versions up to and including 1.22. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). This flaw allows an attacker to execute arbitrary code remotely without any authentication.