CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- rankmath rank math seo – ai seo tools to dominate seo rankings, seo, seo ai seo tools to dominate seo rankings +2 moreRank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Authenticated (Administrator+) PHP Object Injection7.2 High
- apache avro, apache software foundation avro java sdk, netapp active iq unified manager +1 more +3 moreApache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)9.2 Critical
- sophos intercept xA local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device...8.8 High
- ultrapressUltraPress <= 1.2.2 - Authenticated (Contributor+) PHP Object Injection8.8 High
- ultrapress empowerment, empowerment theme for wordpress +1 moreEmpowerment <= 1.0.2 - Authenticated (Contributor+) PHP Object Injection8.8 High
- ultrapress unseen blogUnseen Blog <= 1.0.0 - Authenticated (Contributor+) PHP Object Injection8.8 High
- apache lucene replicatorApache Lucene Replicator: Security Vulnerability in Lucene Replicator - Deserialization Issue5.1 Medium
- givew donation plugin and fundraising platform, givewp, stellarwp givewp – donation plugin and fundraising platform +2 moreGiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection9.8 Critical
- piwebsolution product enquiry for woocommerce, rajeshsingh520 piweb product enquiry or product catalog for woocommerce +1 moreProduct Enquiry for WooCommerce <= 2.2.33.33 - Authenticated (Author+) PHP Object Injection in enquiry_detail.php8.8 High
- ibm cloud pak for multicloud management, cloud pak for multicloud management monitoring +1 moreIBM ManageIQ command execution7.2 High
- progress software telerik ui for wpf, telerik ui for wpf +1 moreProgress UI for WPF format provider unsafe deserialization vulnerability7.8 High
- progress software telerik ui for wpf, telerik ui for wpf +1 moreProgress UI for WPF format provider unsafe deserialization vulnerability7.8 High
- prisna google website translator, gwt – google website translator, gwt-google website translator +2 morePrisna GWT - Google Website Translator <= 1.4.11 - Authenticated (Admin+) PHP Object Injection9.1 Critical
- awesomemotive easy digital downloads, smub easy digital downloads – ecommerce payments and subscriptions made easy +1 moreEasy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR Deserialization7.2 High
- apache hertzbeatApache HertzBeat: RCE by snakeYaml deser load malicious xml8.8 High
- google reverbObject deserialization in Reverb leading to RCE5.7 Medium
- antfin sofa-hessianRemote Command Execution(RCE) Vulnerbility in sofa-hessian9.8 Critical
- sqlitedictsqlitedict insecure deserialization vulnerability9.8 Critical
- langchain, langchain-ai langchain-ai/langchain +1 moreDeserialization of Untrusted Data in langchain-ai/langchain5.2 Medium
- apache seataApache Seata: Remote Code Execution vulnerability via Hessian Deserialization in Apache Seata Server9.8 Critical
- h2o, h2oai h2o-3 +1 moreh2oai h2o-3 JDBC Connection 1 getConnectionSafe deserialization6.9 Medium
- benjaminprojas wp editorWP Editor <= 1.2.9 - Authenticated (Admin+) PHAR Deserialization7.2 High
- adobe coldfusionColdFusion | Deserialization of Untrusted Data (CWE-502)9.8 Critical
- solarwinds access rights managerSolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution9.0 Critical
- mindsdbMindsDB Deserialization of Untrusted Data vulnerability7.1 High
- mindsdbMindsDB Deserialization of Untrusted Data vulnerability7.1 High
- mindsdbMindsDB Deserialization of Untrusted Data vulnerability7.1 High
- mindsdbMindsDB Deserialization of Untrusted Data vulnerability8.8 High
- cleanlabCleanlab Deserialization of Untrusted Data vulnerability7.8 High
- ivanti epm, endpoint manager +1 moreDeserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024...10.0 Critical
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Denial of Service Vulnerability6.5 Medium
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability7.2 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.8 High
- loftware spectrumLoftware Spectrum before 4.6 HF13 Deserializes Untrusted Data.9.8 Critical
- elastic kibanaA deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to...9.9 Critical
- thinkphpThinkPHP deserialization vulnerability9.8 Critical
- veeam backup & replication, backup and recovery, backup \& replication +2 moreA deserialization of untrusted data vulnerability with a malicious payload can allow an...9.8 Critical
- h2o, h2oai h2o-3 +1 moreH2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL9.1 Critical
- shafayat-alam attire, wpattire attire blocks +1 moreAttire <= 2.0.6 - Authenticated (Contributor+) PHP Object Injection8.8 High
- theeventscalendar events calendar pro, the events calendar pro +1 moreThe Events Calendar Pro <= 7.0.2 - Authenticated (Administrator+) PHP Object Injection to Remote Code Execution9.1 Critical
- muffingroup bethemeBetheme <= 27.5.6 - Authenticated (Contributor+) PHP Object Injection8.8 High
- delta electronics dtn soft, deltaww dtnsoft +1 morePath Traversal in Ocean Data Systems Dream Report8.4 High
- eyecix jobsearch, jobsearch wp job board +1 moreWordPress JobSearch WP Job Board WordPress Plugin plugin <= 2.5.3 - PHP Object Injection vulnerability9.8 Critical
- mndpsingh287 theme editorTheme Editor <= 2.8 - Authenticated (Admin+) PHAR Deserialization7.2 High
- bdthemes ultimate store kit, ultimate store kit – addon for woocommerce, edd and elementor, utlimate store kit elementor addons +2 moreUltimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.0.3 - Unauthenticated PHP Object Injection9.8 Critical
- presstigers simple job boardSimple Job Board <= 2.12.3 - Authenticated (Editor+) PHP Object Injection7.2 High
- bdthemes ultimate store kit, ultimate store kit – addon for woocommerce, edd and elementor +1 moreUltimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 1.6.4 - Unauthenticated PHP Object Injection9.8 Critical
- apache hertzbeatGHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import8.8 High
- zendesk samsonGHSL-2023-136_Samson8.8 High
- go-tribe gotribe-adminGo-Tribe gotribe-admin Log routes.go InitRoutes deserialization5.1 Medium
- Show moreLoading…