CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- aipower, senols ai puffer – your ai engine for wordpress (formerly ai power) +1 moreAI Power: Complete AI Pack <= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg_export_prompts7.2 High
- repute infosystems arpriceWordPress ARPrice plugin <= 4.1.3 - PHP Object Injection vulnerability8.8 High
- repute infosystems arpriceWordPress ARPrice plugin <= 4.1.3 - Unauthenticated PHP Object Injection vulnerability9.8 Critical
- instawp string locatorString Locator <= 2.6.6 - Unauthenticated PHP Object Injection8.8 High
- aenrich a+hrd, a\+hrd +1 moreaEnrich Technology a+HRD - Insecure Deserialization7.2 High
- schneider electric remoteconnect and scadapack x70 utilitiesCWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of...8.5 High
- t2bot matrix-media-repoUntrusted file formats can be thumbnailed, invoking potentially further untrusted decoders in Matrix Media Repo6.8 Medium
- microsoft 365 apps, 365 apps for enterprise, office ltsc 2024 +1 more +3 moreMicrosoft Excel Security Feature Bypass Vulnerability7.8 High
- No product listedAquilaCMS categories deserialization6.9 Medium
- ivanti endpoint managerDeserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and...7.8 High
- rasahq rasa-pro-security-advisoriesRemote Code Execution via Remote Model Loading in Rasa9.1 Critical
- wangl1989 mysiteformeMSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the...9.1 Critical
- wangl1989 mysiteformeMSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the...9.1 Critical
- wangl1989 mysiteformeMSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the...9.1 Critical
- wangl1989 mysiteformeMSFM before v2025.01.01 was discovered to contain a deserialization vulnerability via the pom.xml...7.5 High
- givewpWordPress GiveWP Plugin <= 3.19.3 - PHP Object Injection vulnerability9.8 Critical
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection9.8 Critical
- premio coupon x – discount popups & promo codes pop ups for woocommerceCoupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups <= 1.3.5 - Missing Authorization to Authenticated (Contributor+) PHP Object Injection7.5 High
- drupal eloquaEloqua - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-0636.6 Medium
- drupal node export, node export project export +1 moreNode export - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-0616.6 Medium
- kkarpieszuk wc price history for omnibusWordPress WC Price History for Omnibus plugin <= 2.1.4 - PHP Object Injection vulnerability7.2 High
- apache openmeetingsApache OpenMeetings: Deserialisation of untrusted data in cluster mode9.8 Critical
- amentotech private limited wpguppyWordPress WPGuppy plugin <= 1.1.0 - PHP Object Injection vulnerability9.8 Critical
- plainware locatoraid store locatorWordPress Locatoraid Store Locator Plugin <= 3.9.50 - PHP Object Injection vulnerability8.1 High
- plainware plaininventoryWordPress PlainInventory – Inventory Management Plugin Plugin <= 3.1.6 - PHP Object Injection vulnerability8.1 High
- a3rev compare products for woocommerceCompare Products for WooCommerce <= 3.2.1 - Unauthenticated PHP Object Injection8.1 High
- eherman24 custom product tabs for woocommerceCustom Product Tabs for WooCommerce <= 1.8.5 - Authenticated (Shop Manager+) PHP Object Injection7.2 High
- No product listedA vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the...9.8 Critical
- No product listedInvoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an...8.8 High
- salesagility suitecrmAn issue was discovered in SuiteCRM 7.12.7. Authenticated users can use CRM functions to upload...8.8 High
- mediatek lr12a, lr13, nr15 +3 more +5 moreIn Modem, there is a possible system crash due to a logic error. This could lead to remote denial...7.5 High
- wangl1989 mysiteformewangl1989 mysiteforme ShiroConfig.java rememberMeManager deserialization5.3 Medium
- davidanderson updraftplus: wp backup & migration pluginUpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection8.8 High
- inisev backupbliss – backup & migration with free cloud storageBackup Migration <= 1.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialize_replace'8.8 High
- google androidIn checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to...7.8 High
- azzaroco wp superbackupWordPress WP SuperBackup plugin <= 2.3.3 - Subscriber+ PHP Object Injection vulnerability7.5 High
- running-elephant datartrunning-elephant Datart File Upload import extractModel deserialization5.3 Medium
- apache minaApache MINA: MINA applications using unbounded deserialization may allow RCE10.0 Critical
- webbuilder143 custom product tabs for woocommerceCustom Product Tabs For WooCommerce <= 1.2.4 - Authenticated (Shop Manager+) PHP Object Injection7.2 High
- delta electronics dtm softDelta Electronics DTM Soft Deserialization of Untrusted Data8.5 High
- ni daqexpressDeserialization Of Untrusted Data Vulnerability In NI DAQExpress Project File8.4 High
- denniskravetstns vrpconnectorWordPress VRPConnector plugin <= 2.0.1 - PHP Object Injection vulnerability9.8 Critical
- plextracInsecure YAML Deserialization8.6 High
- progress software telerik ui for wpf, telerik ui for wpf +1 moreProgress UI for WPF format provider unsafe deserialization vulnerability8.4 High
- ultimate member forumwpWordPress ForumWP plugin <= 2.1.0 - PHP Object Injection vulnerability9.8 Critical
- themeum wp mega menuWordPress WP Mega Menu plugin <= 1.4.2 - PHP Object Injection vulnerability7.2 High
- pickplugins mail pickerWordPress Mail Picker plugin <= 1.0.14 - PHP Object Injection vulnerability9.8 Critical
- plextracInsecure Deserialization via Runbooks Imports8.6 High
- microsoft update catalogMicrosoft Update Catalog Elevation of Privilege Vulnerability9.3 Critical
- john weissberg print science designerPrint Science Designer <= 1.3.152 - Unauthenticated PHP Object Injection8.1 High
- Show moreLoading…