CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- morehubbub hubbub lite, nerdpress hubbub lites, nerdpressteam hubbub lite – fast, free social sharing and follow buttons +2 moreHubbub Lite – Fast, Reliable Social Network Sharing Buttons <= 1.33.1 - PHP Object Injection7.5 High
- cmb2CMB2 <= 2.10.1 - Authenticated (Contributor+) PHP Object Injection7.5 High
- presstigers simple job boardSimple Job Board <= 2.11.0 - Unauthenticated PHP Object Injection via Job Application Fields9.8 Critical
- linkwhisper link whisper freeLink Whisper Free <= 0.7.1 - Authenticated (Contributor+) PHP Object Injection8.8 High
- binary-husky gpt academicGPT Academic: Pickle deserializing cookies may pose RCE risk9.8 Critical
- eyoucmsEyouCMS Backend deserialization4.7 Medium
- pickplugins product designerWordPress Product Designer plugin <= 1.0.32 - PHP Object Injection vulnerability8.7 High
- vjinfotech wp import export liteWordPress WP Import Export Lite & WP Import Export plugin <= 3.9.26 - PHP Object Injection vulnerability4.4 Medium
- xuxueli xxl-jobXuxueli xxl-job Template JdkSerializeTool.java deserialize injection3.5 Low
- wordpress, wordpress wordpress-develop +1 moreRemote Code Execution in `WP_HTML_Token`5.5 Medium
- a wp life modal popup boxModal Popup Box – Popup Builder, Show Offers And News in Popup <= 1.5.2 - Authenticated (Contributor+) PHP Object Injection in awl_modal_popup_box_shortcode8.8 High
- alldataAlldata V0.4.6 is vulnerable to Command execution vulnerability. System commands can be...9.8 Critical
- voltronic power viewpower pro, voltronicpower viewpower +1 moreVoltronic Power ViewPower Pro Deserialization of Untrusted Data Remote Code Execution Vulnerability9.8 Critical
- alldataA deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to...9.8 Critical
- filter custom fields & taxonomies light custom fields & taxonomies light, websupporter filter custom fields & taxonomies light, filter custom fields and taxonomies light custom fields and taxonomies light +2 moreWordPress Filter Custom Fields & Taxonomies Light plugin <= 1.05 - PHP Object Injection vulnerability8.5 High
- wpdeveloper essential addons for elementor, wpdevteam essential addons for elementor – popular elementor templates & widgets +1 moreEssential Addons for Elementor <= 5.9.13 - Authenticated (Author+) PHP Object Injection via error_resetpassword8.8 High
- burgersoftware buttonButton <= 1.1.27 - Authenticated (Contributor+) PHP Object Injection in button_shortcode8.8 High
- weblizar lightbox slider – responsive lightbox galleryLightbox slider – Responsive Lightbox Gallery <= 1.9.9 - Authenticated (Contributor+) PHP Object Injection5.4 Medium
- mainwp links manager extensionWordPress MainWP Links Manager Extension Plugin <= 2.1 - Unauthenticated PHP Object Injection Vulnerability8.1 High
- sunshinephotocart sunshine photo cartWordPress Sunshine Photo Cart plugin <= 3.1.1 - PHP Object Injection vulnerability5.4 Medium
- repute infosystems armemberWordPress ARMember plugin <= 4.0.26 - PHP Object Injection vulnerability8.5 High
- repute infosystems armemberWordPress ARMember plugin <= 4.0.26 - Unauthenticated PHP Object Injection vulnerability9.0 Critical
- wholesale wholesalexWordPress WholesaleX plugin <= 1.3.2 - Unauthenticated PHP Object Injection vulnerability10.0 Critical
- wpengine wp migrateWordPress WP Migrate plugin <= 2.6.10 - Unauthenticated PHP Object Injection vulnerability10.0 Critical
- wpdeveloper betterdocsWordPress BetterDocs plugin <= 3.3.3 - Unauthenticated PHP Object Injection vulnerability9.0 Critical
- infinitum form geo controllerWordPress Geo Controller plugin <= 8.6.4 - PHP Object Injection vulnerability9.0 Critical
- hercules design core, themesinflow hercules core +1 moreWordPress Hercules Core plugin <= 6.4 - Auth. PHP Object Injection vulnerability9.9 Critical
- givewpWordPress Give plugin <= 3.4.2 - PHP Object Injection vulnerability8.0 High
- acowebs pdf invoices and packing slips for woocommerceWordPress PDF Invoices and Packing Slips For WooCommerce plugin <= 1.3.7 - PHP Object Injection vulnerability8.2 High
- netweblogic meta tag managerMeta Tag Manager <= 3.0.2 - Authenticated (Subscriber+) PHP Object Injection8.8 High
- echo plugins knowledge base for documentation, faqs with ai assistance, echoplugins knowledge base for documentation faqs with ai assistance +1 moreWordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 11.30.2 - PHP Object Injection vulnerability8.7 High
- wpeverest user registration, user registration \& membership +1 moreWordPress User Registration plugin <= 2.3.2.1 - Authenticated PHP Object Injection vulnerability7.4 High
- ruby rdocRDoc RCE vulnerability with .rdoc_options4.5 Medium
- svenl77 buddypress woocommerce my account integration. create woocommerce member pages, themekraft buddypress woocommerce my account integration +1 moreBuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.20 - Authenticated (Subscriber+) PHP Object Injection in get_simple_request8.8 High
- gibbonedu gibbonGibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks...8.8 High
- friends of symfony project fosuserbundle, friendsofsymfony1 symfony1 +1 moreGadget chain in Symfony 1 due to uncontrolled unserialized input in sfNamespacedParameterHolder9.8 Critical
- property hive propertyhiveWordPress PropertyHive plugin <= 2.0.9 - PHP Object Injection vulnerability5.4 Medium
- ibm qiskit ibm runtime, qiskit qiskit-ibm-runtime +1 more`qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code5.3 Medium
- progress telerik reportingProgress Telerik Reporting Remote Deserialization Vulnerability8.5 High
- progress telerik reportingProgress Telerik Reporting Local Deserialization Vulnerability7.7 High
- progress telerik report serverProgress Telerik Report Server Deserialization9.9 Critical
- social media share buttons by sygnoos media share buttons, sygnoos social media share buttons +1 moreWordPress Social Media Share Buttons plugin <= 2.1.0 - PHP Object Injection vulnerability8.2 High
- themefic tourficWordPress Tourfic plugin <= 2.11.17 - PHP Object Injection vulnerability8.5 High
- schneider electric ecostruxure power design - ecodial, schneider-electric ecostruxure power monitoring expert +1 moreCWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code...7.8 High
- sygnoos social media share buttonsSocial Media Share Buttons <= 2.1.0 - Authenticated (Subscriber+) PHP Object Injection8.8 High
- friendsofsymfony1 symfony1, friends of symfony project fosuserbundle +1 moreGadget chain in Symfony 1 due to vulnerable Swift Mailer dependency5.0 Medium
- wpwax product carousel slider & grid ultimate for woocommerce, product carosel slider \& grid ultimate, product carousel slider \& grid ultimate for woocommerce +2 moreProduct Carousel Slider & Grid Ultimate for WooCommerce <= 1.9.7 - Authenticated(Contributor+) PHP Object Injection7.5 High
- wpwax logo showcase ultimate – logo carousel, logo slider & logo grid, logo showcase ultimate +1 moreLogo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid <= 1.3.8 - Authenticated(Contributor+) PHP Object Injection7.5 High
- wpwax post grid, slider & carousel ultimate – with shortcode, gutenberg block & elementor widget, post grid\, slider \& carousel ultimate +1 morePost Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.7 - Authenticated (Contributor+) PHP Object Injection in outpost_shortcode_metabox_markup8.8 High
- hammadh play.ht, play.ht – make your blog posts accessible with text to speech audio, pay.ht make your blog posts accessible with text to speech audio +2 morePlay.ht – Make Your Blog Posts Accessible With Text to Speech Audio <= 3.6.4 - Authenticated (Contributor+) PHP Object Injection8.8 High
- Show moreLoading…