CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- flink-extended ai-flow, aiflow +1 moreflink-extended ai-flow workflow_command.py cloudpickle.loads deserialization5.0 Medium
- standford gibsonenvStanfordVL GibsonEnv pposgd_fuse.py cloudpickle.load deserialization5.0 Medium
- van der schaar lab synthcity, vanderschaarlab temporai +1 morevan_der_Schaar LAB synthcity PKL File load_from_file deserialization6.3 Medium
- cisco packaged contact center enterprise, unified communications manager, unified communications manager / cisco unity connection +5 more +7 moreA vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products...9.9 Critical
- van der schaar lab temporaivan_der_Schaar LAB TemporAI PKL File load_from_file deserialization6.3 Medium
- quarkus, red hat build of optaplanner 8, build of quarkus 2.13.9.final +4 more +6 moreQuarkus: json payload getting processed prior to security checks when rest resources are used with annotations.8.6 High
- apache airflowApache Airflow: Potential pickle deserialization vulnerability in XComs7.5 High
- asgaros forum, thomas belser asgaros forum +1 moreWordPress Asgaros Forum Plugin <= 2.7.2 is vulnerable to PHP Object Injection8.7 High
- quantumcloud chatbot with ai, wpbot +1 moreWordPress ChatBot Plugin <= 5.1.0 is vulnerable to PHP Object Injection8.7 High
- sofastack sofarpc, sofa-rpc +1 moreSOFARPC Remote Command Execution(RCE) Vulnerbility9.8 Critical
- clojureClojure classes can be used to craft a serialized object that runs arbitrary code on deserialization9.8 Critical
- llamahubUnsafe yaml deserialization in llama-hub9.8 Critical
- hecheng leadshopHecheng Leadshop leadshop.php deserialization7.3 High
- nextend smart slider 3WordPress Smart Slider 3 Plugin <= 3.5.1.9 is vulnerable to PHP Object Injection4.3 Medium
- profilepress membership team paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, properfraction profilepress +1 moreWordPress ProfilePress Plugin <= 4.3.2 is vulnerable to PHP Object Injection6.6 Medium
- iperov deepfacelabDeepFaceLab Util.py deserialization5.3 Medium
- zhicmsZhiCms giftcontroller.php deserialization7.3 High
- oracle graalvm, graalvm for jdk, jdk +6 more +8 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...5.9 Medium
- strategy11 formidable formsFormidable Forms < 6.2 - Unauthenticated PHP Object Injection7.5 High
- estatik, unknown estatik real estate plugin +1 moreEstatik Real Estate Plugin < 4.1.1 - Unauthenticated PHP Object Injection9.8 Critical
- schneider electric easergy studioA CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker...7.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.8 High
- svnlabs html5 mp3 player with folder feedburner playlist freeWordPress HTML5 MP3 Player with Folder Feedburner Plugin <= 2.8.0 is vulnerable to PHP Object Injection9.1 Critical
- live composer team page builder: live composer, blueastral page builder\ +1 moreWordPress Page Builder: Live Composer Plugin <= 1.5.25 is vulnerable to PHP Object Injection7.7 High
- repute infosystems armember – membership plugin, content restriction, member levels, user profile & user signup, reputeinfosystems armember +1 moreWordPress ARMember Plugin <= 4.0.22 is vulnerable to Cross Site Request Forgery (CSRF) leading to PHP Object Injection9.6 Critical
- svnlabs html5 soundcloud player with playlist freeWordPress HTML5 SoundCloud Player Plugin <= 2.8.0 is vulnerable to PHP Object Injection9.1 Critical
- svnlabs html5 mp3 player with playlist freeWordPress HTML5 MP3 Player with Playlist Free Plugin <= 3.0.0 is vulnerable to PHP Object Injection9.1 Critical
- kutethemes ovic responsive wpbakeryOvic Responsive WPBakery < 1.2.9 - Subscriber+ Option Update8.8 High
- revolution slider slider revolutionSlider Revolution < 6.6.19 - Author+ Insecure Deserialization leading to RCE8.8 High
- anton bond woocommerce tranzila payment gatewayWordPress WooCommerce Tranzila Gateway Plugin <= 1.0.8 is vulnerable to PHP Object Injection10.0 Critical
- gecka terms thumbnailsWordPress Gecka Terms Thumbnails Plugin <= 1.1 is vulnerable to PHP Object Injection9.9 Critical
- tagbox – ugc galleries, social media widgets, user reviews & analytics, taggbox +1 moreWordPress Taggbox Plugin <= 3.1 is vulnerable to PHP Object Injection10.0 Critical
- fhs-opensource iparkingfhs-opensource iparking vueLogin deserialization6.3 Medium
- apache inlongApache InLong: Arbitrary File Read Vulnerability in Apache InLong Manager7.5 High
- jeecgDeserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows...9.8 Critical
- yith woocommerce product add-ons, yithemes yith woocommerce product add-ons +1 moreWordPress YITH WooCommerce Product Add-Ons Plugin <= 4.3.0 is vulnerable to PHP Object Injection9.1 Critical
- presslabs theme per userWordPress Theme per user Plugin <= 1.0.1 is vulnerable to PHP Object Injection10.0 Critical
- ari soft stream quiz – wordpress quizzes builder, ari-soft ari stream quiz +1 moreWordPress ARI Stream Quiz Plugin <= 1.3.0 is vulnerable to PHP Object Injection9.9 Critical
- dattateccom envíalosimple: email marketing y newsletters, donweb envialosimple\ +1 moreWordPress EnvíaloSimple Plugin <= 2.1 is vulnerable to PHP Object Injection9.6 Critical
- saleswonder webinarignition, saleswonder team webinar plugin: create live/evergreen/automated/instant webinars, stream & zoom meetings | webinarignition +1 moreWordPress WebinarIgnition Plugin <= 3.05.0 is vulnerable to PHP Object Injection9.9 Critical
- boiteasite rencontre, jacques malgrange rencontre – dating site +1 moreWordPress Rencontre – Dating Site Plugin <= 3.11.1 is vulnerable to PHP Object Injection9.9 Critical
- realmag777 active products tables for woocommerce. professional products tables for woocommerce store, pluginus woot +1 moreWordPress Active Products Tables for WooCommerce Plugin <= 1.0.6 is vulnerable to PHP Object Injection10.0 Critical
- themehigh job manager & career – manage job board listings, and recruitments, job manager \& career +1 moreWordPress Job Manager & Career Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF) leading to PHP Object Injection9.6 Critical
- givewp, givewp – donation plugin and fundraising platform, stellarwp givewp – donation plugin and fundraising platform +2 moreWordPress GiveWP Plugin <= 2.25.3 is vulnerable to PHP Object Injection7.5 High
- woocommerce product add-ons, product addons +1 moreWordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to PHP Object Injection8.2 High
- gesundheit bewegt gmbh zippyWordPress Zippy Plugin <= 1.6.5 is vulnerable to PHP Object Injection6.6 Medium
- jamieblomerus unofficial mobile bankid integration, wp-mobile-bankid-integration +1 moreWP-Mobile-BankID-Integration WordPress Database Deserialization: Potential for Object Injection6.4 Medium
- rws worldserverAn issue was discovered in RWS WorldServer before 11.7.3. /clientLogin deserializes Java objects...9.8 Critical
- xtemos woodmart, woodmart - multipurpose woocommerce theme +1 moreWordPress Woodmart Core Plugin <= 1.0.36 is vulnerable to PHP Object Injection9.8 Critical
- dmry sayfa sayacWordPress Sayfa Sayaç Plugin <= 2.6 is vulnerable to PHP Object Injection10.0 Critical
- Show moreLoading…