CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- pgadmin 4, pgadmin.org pgadmin 4, fedoraproject fedora +2 moreUnsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 49.9 Critical
- acowebs pdf invoices and packing slips for woocommerce, pdf invoices and packing slips +1 morePDF Invoices and Packing Slips For WooCommerce <= 1.3.7 - Authenticated (Subscriber+) PHP Object Injection8.8 High
- naver ngrindernGrinder vulnerable to unsafe Java objects deserialization9.8 Critical
- naver ngrindernGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute...9.8 Critical
- naver ngrindernGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be...9.8 Critical
- pmmp pocketmine-mpPocketMine-MP before 5.11.1 Denial of Service via LoginPacket8.7 High
- apache inlongApache InLong: Logged-in user could exploit an arbitrary file read vulnerability9.1 Critical
- artica tech proxy, articatech artica proxy +1 moreArtica Proxy Unauthenticated PHP Deserialization Vulnerability9.8 Critical
- dave kiss vimeography: vimeo video gallery wordpress plugin, davekiss vimeography +1 moreVimeography: Vimeo Video Gallery WordPress Plugin <= 2.3.2 - Authenticated (Contributor+) PHP Object Injection8.8 High
- jkohlbach auto refresh single page, joshkohlbach auto-refresh-single-page +1 moreAuto Refresh Single Page <= 1.1 - Authenticated (Contributor+) PHP Object Injection8.8 High
- prestalife product designer, prestashopmodules productdesigner +1 moreAn issue was discovered in Tunis Soft "Product Designer" (productdesigner) module for PrestaShop...9.8 Critical
- solarwinds security event managerSolarWinds Security Event Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability8.8 High
- awordpresslife responsive slideshow, awplife slider responsive slideshow +1 moreSlider Responsive Slideshow – Image slider, Gallery slideshow <= 1.3.8 - Authenticated (Contributor+) PHP Object Injection8.8 High
- google androidIn writeUserLP of UserManagerService.java, device policies are serialized with an incorrect tag...5.5 Medium
- clojure, fedoraproject fedora +1 moreReading specially crafted serializable objects from an untrusted source may cause an infinite loop and denial of service7.5 High
- apache james, james server +1 moreApache James server: Privilege escalation via JMX pre-authentication deserialisation9.8 Critical
- temmokumvcTemmokuMVC Image Download images_get_down.php img_replace deserialization5.6 Medium
- van der schaar lab autoprognosisvan_der_Schaar LAB AutoPrognosis Release Note load_model_from_file deserialization5.0 Medium
- apache hertzbeatHertzBeat SnakeYAML Deser RCE9.8 Critical
- dompdf php-svg-libphp-svg-lib lacks path validation on font through SVG inline styles6.8 Medium
- apache camelApache Camel: Camel-CassandraQL: Unsafe Deserialization from CassandraAggregationRepository9.8 Critical
- apache camelApache Camel: Camel-SQL: Unsafe Deserialization from JDBCAggregationRepository7.8 High
- torrentpierTorrentpier 2.4.1 - RCE10.0 Critical
- huawei emui, harmonyos +1 moreVulnerability of serialization/deserialization mismatch in the vibration framework.Successful...7.5 High
- oracle agile product lifecycle management (plm), agile plm framework, agile product lifecycle management +2 moreVulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The...8.8 High
- solarwinds access rights managerSolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution9.0 Critical
- solarwinds access rights managerSolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution8.0 High
- intel thunderbolt dch driverDeserialization of untrusted data in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before...3.8 Low
- drupal, drupal core +1 moreDrupal core - Moderately critical - Gadget chain - SA-CORE-2024-0089.8 Critical
- drupal, drupal core +1 moreDrupal core - Moderately critical - Gadget chain - SA-CORE-2024-0079.8 Critical
- drupal, drupal core +1 moreDrupal core - Less critical - Gadget chain - SA-CORE-2024-0069.8 Critical
- kalli dan. kd coming soonWordPress KD Coming Soon Plugin <= 1.7 is vulnerable to PHP Object Injection5.4 Medium
- wpxpo productx – woocommerce builder & gutenberg woocommerce blocks, wowstore +1 moreWordPress ProductX – Gutenberg WooCommerce Blocks Plugin <= 3.1.4 is vulnerable to PHP Object Injection8.7 High
- property hive propertyhiveWordPress PropertyHive Plugin <= 2.0.5 is vulnerable to PHP Object Injection8.7 High
- magepeople team event manager and tickets selling plugin for woocommerce – wpevently – wordpress plugin, mage-people event manager and tickets selling for woocommerce +1 moreWordPress Event Manager for WooCommerce Plugin <= 4.1.1 is vulnerable to PHP Object Injection8.2 High
- g5plus ere recently viewed, g5theme ere recently viewed – essential real estate add-on, essential real estate +2 moreWordPress ERE Recently Viewed Plugin <= 1.3 is vulnerable to PHP Object Injection9.8 Critical
- unitedthemes brooklyn, brooklyn | creative multi-purpose responsive wordpress theme, brooklyn creativie multi purpose responsive wordpress theme +2 moreWordPress Brooklyn Theme <= 4.9.7.6 is vulnerable to PHP Object Injection7.5 High
- wp swings coupon referral programWordPress Coupon Referral Program plugin < 1.8.4 - Unauthenticated PHP Object Injection vulnerability10.0 Critical
- gambioDeserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary...9.8 Critical
- iperov deepfacelabDeepFaceLab main.py apply_xseg deserialization5.0 Medium
- phpemsPHPEMS index.api.php index deserialization6.3 Medium
- allegro.ai clearmlAllegro AI ClearML vulnerable to deserialization of untrusted data8.0 High
- sigmaplugin advanced database cleaner, symptote advanced database cleaner – optimize & clean database to speed up site performance +1 moreAdvanced Database Cleaner <= 3.1.3 - Authenticated(Administrator+) PHP Object Injection via process_bulk_action6.6 Medium
- wpengine better search replaceBetter Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection8.8 High
- qibosoft qibocms x1QiboSoft QiboCMS X1 Pay.php rmb_pay deserialization7.3 High
- openbiopenBI Phar User.php addxinzhi deserialization6.3 Medium
- ibm operational decision managerIBM Operational Decision Manager code execution9.8 Critical
- dataeaseThe Dataease datasource exists deserialization and arbitrary file read vulnerability9.1 Critical
- wukongopensource wukongcrm, 5kcrm wukong crm +1 moreAn issue in WuKongOpenSource WukongCRM v.72crm_9.0.1_20191202 allows a remote attacker to execute...9.8 Critical
- openbi project openbiopenBI Test Connection Databasesource.php testConnection deserialization7.3 High
- Show moreLoading…