CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution10.0 Critical
- mycredWordPress myCred plugin <= 2.7.2 - PHP Object Injection vulnerability9.8 Critical
- crew hrm hrm, crewhrm +1 moreWordPress Crew HRM plugin <= 1.1.1 - PHP Object Injection vulnerability9.0 Critical
- azzaroco ultimate membership proWordPress Indeed Ultimate Membership Pro plugin <= 12.7 - Unauthenticated PHP Object Injection vulnerability9.0 Critical
- givewpWordPress GiveWP plugin <= 3.14.1 - Unauthenticated PHP Object Injection vulnerability10.0 Critical
- solarwinds web help desk, webhelpdesk +1 moreSolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability9.8 Critical
- roland barker, xnau webdesign participants databaseWordPress Participants Database plugin <= 2.5.9.2 - PHP Object Injection vulnerability9.8 Critical
- buywptemplates multipurposeMultiPurpose <= 1.2.0 - Authenticated (Contributor+) PHP Object Injection8.8 High
- codename065 news flash, newsflash +1 moreNews Flash <= 1.1.0 - Authenticated (Editor+) PHP Object Injection7.2 High
- shahriar0822 the nextThe Next <= 1.1.0 - Authenticated (Contributor+) PHP Object Injection8.8 High
- ivanti epmm, endpoint manager mobile +1 moreAn insecure deserialization vulnerability in web component of EPMM prior to 12.1.0.1 allows an...8.8 High
- codesolz better find and replaceWordPress Better Find and Replace plugin <= 1.6.1 - PHP Object Injection vulnerability8.3 High
- motopress timetable and event scheduleWordPress Timetable and Event Schedule by MotoPress plugin <= 2.4.13 - PHP Object Injection vulnerability5.5 Medium
- wptexture flipbox builderFlipbox Builder <= 1.5 - Authenticated (Contributor+) PHP Object Injection8.8 High
- huawei emui, harmonyos +1 moreVulnerability of serialisation/deserialisation mismatch in the iAware module. Impact: Successful...6.8 Medium
- kirilkirkov ecommerce-laravel-bootstrap, ecommerce-codeigniter-bootstrap +1 morekirilkirkov Ecommerce-Laravel-Bootstrap Cart.php getCartProductsIds deserialization5.3 Medium
- progress telerik report server, telerik reporting +1 moreProgress Telerik Report Server Deserialization9.9 Critical
- ni veristandDeserialization of Untrusted Data in NI VeriStand Waveform Streaming Server9.8 Critical
- ni veristandDeserialization of Untrusted Data in NI VeriStand DataLogging Server9.8 Critical
- ni veristandDeserialization of Untrusted Data Vulnerability in NI VeriStand Project File7.8 High
- unknown search & replace, wp-media search \& replace +1 moreWordPress Search & Replace plugin <= 3.2.2 - Deserialization of untrusted data vulnerability5.4 Medium
- mvnrepository h2o-coreH2O deserializes ML models without filtering, potentially allowing execution of malicious code7.5 High
- crmebZhongBangKeJi CRMEB PublicController.php get_image_base64 deserialization5.3 Medium
- crmebZhongBangKeJi CRMEB CopyTaobaoServices.php downloadImage deserialization5.3 Medium
- wpdiscover timeline event historyTimeline Event History <= 3.1 - Authenticated (Contributor+) PHP Object Injection8.8 High
- solarwinds access rights managerSolarWinds Access Rights Manager (ARM) Internal Deserialization Remote Code Execution Vulnerability9.6 Critical
- torrentpierDeserialization of untrusted data in torrentpier/torrentpier9.8 Critical
- apache linkis, apache software foundation linkis datasource +1 moreApache Linkis DataSource: JDBC Datasource Module with DB2 has JNDI Injection vulnerability8.8 High
- apache linkis, apache software foundation linkis datasource +1 moreApache Linkis DataSource: DataSource Remote code execution vulnerability8.8 High
- wukongopensource wukong nocodeWuKongOpenSource Wukong_nocode AviatorScript ExpressionUtil.java deserialization5.3 Medium
- zmops argusdbmzmops ArgusDBM AviatorScript CalculateAlarm.java getDefaultClassLoader deserialization5.3 Medium
- microsoft sharepoint, sharepoint enterprise server 2016, sharepoint server 2019 +2 more +4 moreMicrosoft SharePoint Remote Code Execution Vulnerability7.2 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability7.2 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability7.2 High
- siemens simatic step 7 safety v18, simatic step 7 +1 moreA vulnerability has been identified in SIMATIC STEP 7 Safety V18 (All versions < V18 Update 2)....7.0 High
- siemens simatic step 7 safety v16, simatic step 7 safety v17, simatic step 7 safety v18 +34 more +36 moreA vulnerability has been identified in SIMATIC STEP 7 Safety V16 (All versions < V16 Update 7),...7.0 High
- siemens simatic pcs neo v4.0, simatic step 7 v16, simatic step 7 v17 +3 more +5 moreA vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC STEP 7 V16 ...8.5 High
- wpweb woocommerce social loginWordPress Social Login plugin <= 2.6.3 - PHP Object Injection vulnerability5.4 Medium
- seopressSEOPress < 7.9 - Unauthenticated Object Injection9.8 Critical
- d-link dar-7000, dlink dar-7000 firmware +1 moreD-Link DAR-7000 decodmail.php deserialization5.1 Medium
- No product listedORIPA LoaderXML.java deserialization5.3 Medium
- splunk, splunk enterprise, enterprise security +2 moreRemote Code Execution through Serialized Session Payload in Splunk Enterprise on Windows8.8 High
- nltkntlk unsafe deserialization vulnerability9.8 Critical
- progress whatsup goldWhatsUp Gold OnMessage Deserialization of Untrusted Data Remote Code Execution Vulnerability7.2 High
- bluditBludit - Remote Code Execution (RCE) through Image API8.9 High
- bluditBludit - Remote Code Execution (RCE) through File API8.9 High
- No product listedMENDELSON AS4 before 2024 B376 has a client-side vulnerability when a trading partner provides...6.5 Medium
- provectus kafka-ui, ui +1 moreRemote code execution via JNDI resolution in JMX metrics collection in Kafka UI8.1 High
- live composer team page builder: live composer, page builder live composer +1 moreWordPress Page Builder: Live Composer plugin <= 1.5.42 - Contributor+ PHP Object Injection vulnerability8.5 High
- webhuntinfotech photo video gallery masterPhoto Video Gallery Master <= 1.5.3 - Authenticated (Contributor+) PHP Object Injection8.8 High
- Show moreLoading…