CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- treeio Treeio through 2.0 Insecure Deserialization RCE via Admin-Editable Pickle Fields 8.6 High
- nasirahmed advanced form integration — connect forms to 300+ apps Advanced Form Integration <= 2.10.2 - Unauthenticated PHP Object Injection via $_POST Parameters 8.1 High
- quarka qa assistants – driven by data QA Assistants <= 5.3.0 - Unauthenticated PHP Object Injection to Remote Code Execution via 'raw_name' and 'dlevent_ver' Parameters 8.8 High
- creativewerkdesigns wpsyncsheets for contact form 7 – cf7 google sheets connector & save to database WPSyncSheets For Contact Form 7 <= 1.8.0 - Unauthenticated PHP Object Injection to Remote Code Execution via Untrusted CF7 Submission Field via maybe_unserialize() 7.5 High
- mamunur rashid radius booking — booking calendar for appointments & services WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability 9.8 Critical
- pymodaq, pymodaq data, gui +1 more +3 more PyMoDAQ before 5.3.10 Arbitrary Code Execution via Crafted HDF5, Dock Layout, and XML Settings Files 8.5 High
- h5io h5io before 0.2.6 Arbitrary Code Execution via read_hdf5 8.5 High
- francescopace espectre ESPectre: Unsafe Deserialization on .npz dataset leads to Code Execution 7.8 High
- quest foglight for databases Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability 9.8 Critical
- mlflow MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability 7.8 High
- mlflow MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability 7.8 High
- perforce puppet enterprise Report Deserialization Code Execution 9.4 Critical
- stanfordnlp stanza Stanza: RCE via pickle deserialization in the lemmatizer 7.8 High
- nist labbench labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch 8.5 High
- themefic ultra addons for contact form 7 Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field 9.8 Critical
- jxxghp moviepilot jxxghp MoviePilot Workflow Fork Endpoint workflow.py WorkflowExecutor.restore_context deserialization 5.1 Medium
- apache software foundation mina Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder 9.8 Critical
- addonsorg pdf invoice for woocommerce + drag and drop template builder PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field 9.8 Critical
- @mikro-orm sql OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution 8.7 High
- trailofbits fickling Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis 8.8 High
- trailofbits fickling Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables 8.8 High
- metalama Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code execution 7.3 High
- stylemix masterstudy lms WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability 8.8 High
- rextheme product feed manager WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerability 7.2 High
- leadsnap WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability 9.8 Critical
- gs plugins testimonial slider WordPress GS Testimonial Slider plugin <= 3.3.10 - PHP Object Injection vulnerability 8.8 High
- shortpixel enable media replace WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerability 8.8 High
- aman funnelkit automations WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability 9.8 Critical
- themerex royal event WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability 9.8 Critical
- frappe lms Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount 5.3 Medium
- internlm lmdeploy LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization 9.3 Critical
- google cloud application integration Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution 9.4 Critical
- chamilo chamilo-lms Chamilo LMS: Database-backed PHP object injection in career deserialization 7.5 High
- gravity forms forms Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field 9.8 Critical
- shortpixel enable media replace Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer 7.5 High
- veeam management pack for microsoft system center A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as... 8.7 High
- veeam management pack for microsoft system center A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on... 9.3 Critical
- unclecode crawl4ai Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name 7.7 High
- 10web social photo feed, unknown 10web social photo feed +1 more WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability 8.8 High
- social snap snap WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability 8.8 High
- foliovision fv flowplayer video player, fv flowplayer video player flowplayer video player +1 more WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - PHP Object Injection vulnerability 7.2 High
- pixelyoursite product catalog feed by pixelyoursite WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability 7.2 High
- fast themes sastra essential addons for elementor WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability 7.2 High
- frisbii pay WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability 8.8 High
- dbarrere wp media folders WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability 8.8 High
- daman jeet finale lite WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability 7.2 High
- blazethemes news kit elementor addons WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability 8.8 High
- mypos payments checkout WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability 7.2 High
- buddydev buddypress xprofile custom field types WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability 8.8 High
- sosidee dynamic qr code – generator WordPress Dynamic QR Code – generator plugin <= 1.0.1 - PHP Object Injection vulnerability 8.8 High
- Show olderLoading…