CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- stephen cui xinWordPress Xin theme <= 1.0.8.1 - PHP Object Injection vulnerability9.8 Critical
- dmc airin blogWordPress Airin Blog theme <= 1.6.1 - PHP Object Injection vulnerability9.8 Critical
- anthony carbon wdes responsive mobile menuWordPress WDES Responsive Mobile Menu plugin <= 5.3.18 - PHP Object Injection vulnerability9.8 Critical
- elastic kibanaKibana arbitrary code execution via YAML deserialization9.1 Critical
- wpvivid migration\, backup\, staging, wpvividplugins migration backup staging wpvivd backup and migration, wpvivid — backup, migration & staging +2 moreMigration, Backup, Staging – WPvivid <= 0.9.107 - Unauthenticated PHP Object Injection8.8 High
- progress software telerik ui for wpf, telerik ui for wpf versions, telerik ui for wpf +2 moreProgress UI for WPF format provider unsafe deserialization vulnerability7.8 High
- progress telerik ui for winforms, progress software telerik ui for wpf versions +1 moreProgress UI for WinForms format provider unsafe deserialization vulnerability7.8 High
- backpackforlaravel filemanager, laravel-backpack file manager +1 moreFileManager Deserialization of Untrusted Data7.7 High
- algolplus advanced order export for woocommerce, advanced order export +1 moreAdvanced Order Export For WooCommerce <= 3.5.5 - Unauthenticated PHP Object Injection via Order Details8.1 High
- citrix session recordingLimited remote code execution with privilege of a NetworkService Account access5.1 Medium
- siemens pp telecontrol server basic 1000 to 5000 v3.1, pp telecontrol server basic 256 to 1000 v3.1, pp telecontrol server basic 32 to 64 v3.1 +11 more +13 moreA vulnerability has been identified in PP TeleControl Server Basic 1000 to 5000 V3.1 (6NH9910...10.0 Critical
- siemens simatic s7-plcsim v16, simatic s7-plcsim v17, simatic step 7 safety v16 +36 more +38 moreA vulnerability has been identified in SIMATIC S7-PLCSIM V16 (All versions), SIMATIC S7-PLCSIM...7.0 High
- x-stream xstream, x-stream +1 moreXStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream7.5 High
- thinkadminThinkAdmin Plugs.php script deserialization2.3 Low
- google androidIn onReceive of AppRestrictionsFragment.java, there is a possible escalation of privilege due to...7.8 High
- apache lucene, lucene.net, apache software foundation lucene.net.replicator +2 moreApache Lucene.Net.Replicator: Remote Code Execution in Lucene.Net.Replicator8.0 High
- delta electronics infrasuite device masterDelta Electronics InfraSuite Device Master Deserialization of Untrusted Data9.3 Critical
- daniel schmitzer ds.downloadlistWordPress DS.DownloadList plugin <= 1.3 - PHP Object Injection vulnerability9.8 Critical
- thinkphpThinkPHP deserialization vulnerability9.8 Critical
- chainerA Deserialization of Untrusted Data vulnerability in chainer v7.8.1.post1 leads to execution of...9.8 Critical
- linuxfoundation pytorchIn PyTorch <=2.4.1, the RemoteModule has Deserialization RCE.9.8 Critical
- bob namaste! lms, kibokolabs namaste\! lms +1 moreWordPress Namaste! LMS plugin <= 2.6.3 - PHP Object Injection vulnerability8.8 High
- wpclever wpc shop as a customer for woocommerceWordPress WPC Shop as a Customer for WooCommerce plugin <= 1.2.6 - PHP Object Injection vulnerability8.8 High
- drupal monster menus, monster menus project menus +1 moreMonster Menus - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-0524.3 Medium
- revmakx backup and staging by wp time capsuleWordPress Backup and Staging by WP Time Capsule plugin <= 1.22.21 - PHP Object Injection vulnerability7.2 High
- giveaway boost boost, giveawayboost giveaway boost +1 moreWordPress Giveaway Boost plugin <= 2.1.4 - PHP Object Injection vulnerability9.8 Critical
- smartdevth advanced advertising systemWordPress Advanced Advertising System plugin <= 1.3.1 - PHP Object Injection vulnerability9.8 Critical
- brandon clark sitebuilder dynamic components, site builder dynamic components +1 moreWordPress SiteBuilder Dynamic Components plugin <= 1.0 - PHP Object Injection vulnerability9.8 Critical
- piyush patel shipyaari shipping managementWordPress Shipyaari Shipping Management plugin <= 1.2 - PHP Object Injection vulnerability9.8 Critical
- chertz wp easy post types, wp easy post types project easy post types +1 moreWP Easy Post Types <= 1.4.4 - Authenticated (Subscriber+) PHP Object Injection8.8 High
- olsonsp4c my reading libraryWordPress My Reading Library plugin <= 1.0 - PHP Object Injection vulnerability9.8 Critical
- admidioAdmidio vulnerable to HTML Injection In The Messages Section3.5 Low
- gmrobbins disc golf managerWordPress Disc Golf Manager plugin <= 1.0.0 - PHP Object Injection vulnerability9.8 Critical
- boyan raichev ip loc8WordPress IP Loc8 plugin <= 1.1 - PHP Object Injection vulnerability9.8 Critical
- gabriele valenti telecash ricaricawebWordPress Telecash Ricaricaweb plugin <= 2.2 - PHP Object Injection vulnerability9.8 Critical
- al imran akash recentlyWordPress Recently plugin <= 1.1 - PHP Object Injection vulnerability9.8 Critical
- taketin to wp membershipWordPress TAKETIN To WP Membership plugin <= 2.8.17 - PHP Object Injection vulnerability8.8 High
- foter free stock photos foterWordPress Free Stock Photos Foter plugin <= 1.5.4 - PHP Object Injection vulnerability8.8 High
- nintechnet ninjafirewall, ninjatechnologiesnetwork ninja firewall, nintechnet ninjafirewall (wp edition) – advanced security plugin and firewall +2 moreNinjaFirewall <= 4.3.3 - Authenticated PHAR Deserialization6.6 Medium
- givewp, stellarwp givewp – donation plugin and fundraising platform, webdevmattcrom givewp donation plugin and fundraising platform +2 moreGiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution9.8 Critical
- oracle graalvm, graalvm for jdk, jdk +2 more +4 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...3.7 Low
- cert vince, cert/cc vince - vulnerability information and coordination environment +1 morePotential DoS Vulnerability in CERT VINCE Software Before Version 3.0.84.9 Medium
- splunk, splunk enterprise +1 moreRemote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on Windows8.8 High
- huangdou utcms, usualtool usualtoolcms +1 moreHuangDou UTCMS template_creat.php deserialization5.3 Medium
- baptiste.gourdin talkbackWordPress Talkback plugin <= 1.0 - PHP Object Injection vulnerability9.8 Critical
- dataeaseDataease PostgreSQL Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability9.3 Critical
hashbrowncrates.ioBorsh serialization of HashMap is non-canonical8.9 High- eyecix jobsearch, jobsearch wp job board +1 moreWordPress WP JobSearch plugin <= 2.5.9 - PHP Object Injection vulnerability9.8 Critical
- pac4jDeserialization of untrusted data in InternalAttributeHandler in pac4j9.2 Critical
- schneider electric ecostruxure power monitoring expert (pme), ecostruxure power monitoring expert +1 moreCWE-502: Deserialization of Untrusted Data vulnerability exists that could allow code to be...7.3 High
- Show moreLoading…