CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft excel, 365 apps, 365 apps for enterprise +7 more +9 moreMicrosoft Excel Remote Code Execution Vulnerability7.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability7.2 High
- veeam service provider consoleDue to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server...9.9 Critical
- jetmonsters hotel booking lite, motopress hotel booking +1 moreHotel Booking Lite <= 4.11.1 - Unauthenticated PHP Object Injection9.8 Critical
- ibm sdk, java technology edition, java software development kit +1 moreIBM SDK, Java Technology Edition denial of service5.9 Medium
- ni flexlogger, instrumentstudio +1 moreDeserialization of Untrusted Data Vulnerability in FlexLogger and InstrumentStudio7.8 High
- d-link dar-8000-10, dlink dar-8000-10 firmware +1 moreD-Link DAR-8000-10 importhtml.php deserialization5.3 Medium
- monetizemore advanced ads – ad manager & adsense, wpadvancedads advanced ads - ad manager \& adsense +1 moreAdvanced Ads – Ad Manager & AdSense <= 1.52.1 - Authenticated (Admin+) PHP Object Injection7.2 High
- jottlieb last viewed posts by wpbeginnerLast Viewed Posts by WPBeginner <= 1.0.0 - Unauthenticated PHP Object Injection9.8 Critical
- metaphorcreations ditty – responsive news tickers, sliders, and listsDitty – Responsive News Tickers, Sliders, and Lists <= 3.1.38 - Authenticated (Contributor+) PHP Object Injection8.8 High
- solarwinds access rights managerSolarWinds ARM Deserialization of Untrusted Data Remote Code Execution9.0 Critical
- ocdi one click demo importWordPress One Click Demo Import plugin <=3.2.0 - PHP Object Injection vulnerability4.4 Medium
- bdthemes ultimate store kit elementor addons, utlimate store kit elementor addons +1 moreWordPress Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder plugin <= 2.0.3 - PHP Object Injection vulnerability5.4 Medium
- dell data manager appliance software (dmas), dm5500 firmware, powerprotect data manager dm5500 firmware +2 moreDell PowerProtect DM5500 version 5.15.0.0 and prior contains an insecure deserialization...2.2 Low
- apache inlongApache Inlong JDBC Vulnerability9.8 Critical
- spatie image optimizerimage-optimizer allows PHAR deserialization8.8 High
- brainstormforce convertplug, brainstorm force convertplus +1 moreConvertPlug <= 3.5.25 - Authenticated (Contributor+) PHP Object Injection8.8 High
- xiboon kurwovkurwov vulnerable to Denial of Service due to improper data sanitization6.2 Medium
- aws sagemaker-python-sdkDeserialization of Untrusted Data in sagemaker-python-sdk7.8 High
- voltronic power viewpowerVoltronic Power ViewPower Deserialization of Untrusted Data Remote Code Execution Vulnerability9.8 Critical
- inductive automation ignitionInductive Automation Ignition ExtendedDocumentCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability8.8 High
- inductive automation ignitionInductive Automation Ignition ResponseParser Notification Deserialization of Untrusted Data Remote Code Execution Vulnerability8.8 High
- inductive automation ignitionInductive Automation Ignition ResponseParser SerializedResponse Deserialization of Untrusted Data Remote Code Execution Vulnerability8.8 High
- inductive automation ignitionInductive Automation Ignition Base64Element Deserialization of Untrusted Data Remote Code Execution Vulnerability7.2 High
- inductive automation ignitionInductive Automation Ignition RunQuery Deserialization of Untrusted Data Remote Code Execution Vulnerability8.8 High
- inductive automation ignitionInductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution Vulnerability8.8 High
- inductive automation ignitionInductive Automation Ignition JavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability9.8 Critical
- inductive automation ignitionInductive Automation Ignition ParameterVersionJavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability9.8 Critical
- inductive automation ignitionInductive Automation Ignition AbstractGatewayFunction Deserialization of Untrusted Data Remote Code Execution Vulnerability8.8 High
- averta shortcodes and extra features for phlox themeShortcodes and extra features for Phlox theme <= 2.17.5 - Authenticated (Subscriber+) PHP Object Injection via auxin_template_control_importer7.5 High
- awplife grid gallery, awordpresslife grid gallery for images +1 moreGrid Gallery – Photo Image Grid Gallery <= 1.4.3 - Authenticated (Contributor+) PHP Object Injection via shortcode7.5 High
- awordpresslife photo gallery for imagesPhoto Gallery <= 1.4.2 - Authenticated(Contributor+) PHP Object Injection via Shortcode7.5 High
- infinitum form geo controllerWordPress Geo Controller < 8.6.5 - PHP Object Injection6.5 Medium
- awplife event monster, awordpresslife event monster – manager & ticket booking +1 moreEvent Monster <= 1.3.9 - Authenticated(Contributor+) PHP Object Injection via Custom Meta7.5 High
- tpm2 software stack project software stack, tpm2-software tpm2-tss +1 moreFapi Verify Quote: Does not detect if quote was not generated by TPM4.3 Medium
- r-project rDeserialization of untrusted data can occur in the R statistical programming language, on any...8.8 High
- 8theme xstore coreWordPress XStore Core plugin <= 5.3.5 - Unauthenticated PHP Object Injection vulnerability9.0 Critical
- team yoast custom field finderWordPress Custom field finder plugin <= 0.3 - PHP Object Injection vulnerability5.4 Medium
- teamnewpipe newpipeNewPipe has potential security vulnerability when importing settings8.5 High
- carazo import and export users and customersWordPress Import and export users and customers plugin <= 1.26.2 - PHP Object Injection vulnerability4.4 Medium
- webtoffee import export wordpress usersWordPress Export and Import Users and Customers plugin <= 2.5.3 - Deserialization of untrusted data vulnerability5.4 Medium
- byzoro smart s80 management platformByzoro Smart S80 Management Platform importhtml.php deserialization6.3 Medium
- averta master sliderWordPress Master Slider plugin <= 3.9.5 - PHP Object Injection vulnerability8.3 High
- themekraft woobuddy, buddypress woocommerce my account integration +1 moreWordPress WooBuddy plugin <= 3.4.20 - PHP Object Injection vulnerability8.5 High
- wp all import import users from csv, wpallimport wp all import +1 moreWordPress Import Users from CSV plugin <= 1.2 - PHP Object Injection4.4 Medium
- cym1102 nginxwebuicym1102 nginxWebUI reload exec deserialization6.3 Medium
- timber team & contributors timberWordPress Timber plugin <= 1.23.0 - Deserialization of untrusted data vulnerability8.0 High
- wpvivid migration\, backup\, staging, wpvividplugins wpvivid — backup, migration & staging +1 moreWPvivid Backup & Migration Plugin <= 0.9.99 - Authenticated (Admin+) PHAR Deserialization7.2 High
- huggingface huggingface/transformers, transformers +1 moreArbitrary Code Execution via Deserialization in huggingface/transformers3.4 Low
- shapedplugin carousel, slider, photo gallery with lightbox, video slider, by wp carousel, logo carousel, post grid\, post carousel\, \& list category posts +1 more +3 moreCarousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Admin+) PHP Object Injec…7.2 High
- Show moreLoading…