CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- metagauss profilegridWordPress ProfileGrid Plugin <= 5.9.4.3 - PHP Object Injection vulnerability8.8 High
- awordpresslife album galleryAlbum Gallery – WordPress Gallery <= 1.6.3 - Authenticated (Editor+) PHP Object Injection via Gallery Meta7.2 High
- No product listedPixelYourSite 10.1.1.1 - Insecure deserialization6.3 Medium
github.com/cosmos/ibc-goGo,github.com/cosmos/ibc-go/v2Go,github.com/cosmos/ibc-go/v3Go +5 more +7 moreIBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement9.3 Critical- wpbranch tabs for woocommerceTabs for WooCommerce <= 1.0.0 - Authentiated (Shop Manager+) PHP Object Injection in product_has_custom_tabs7.2 High
- melapress wp activity logWP Activity Log 5.3.2 - Insecure deserialization6.3 Medium
- No product listedb1gMail Admin Page users.php deserialization5.1 Medium
- flexmls flexmls® idxWordPress Flexmls® IDX Plugin Plugin <= 3.14.27 - PHP Object Injection vulnerability9.8 Critical
- nazmul hasan robin nhr options table managerWordPress NHR Options Table Manager Plugin <= 1.1.2 - Deserialization of untrusted data vulnerability7.2 High
- giuliopanda adfoWordPress ADFO plugin <= 1.9.1 - Deserialization of untrusted data vulnerability7.2 High
- metaslider responsive slider by metasliderWordPress Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider Plugin <= 3.94.0 - PHP Object Injection vulnerability9.8 Critical
- westboy cicadascmswestboy CicadasCMS Template Management system deserialization5.1 Medium
- misterpah mambo importer, mambo joomla importer +1 moreMambo Importer <= 1.0 - Authenticated (Administrator+) PHP Object Injection7.2 High
- ibm qiskit, qiskit sdk +1 moreQiskit SDK denial of service8.6 High
- matiskiba ravpageRavpage <= 2.31 - PHP Object Injection9.8 Critical
- hitachi vantara pentaho business analytics server, pentaho data integration & analytics +1 moreHitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data9.9 Critical
- ibm cognos controller, controller +1 moreIBM Cognos Controller code execution8.8 High
- ibm cognos controller, controller +1 moreIBM Cognos Controller CSV injection8.0 High
- wecantrack affiliate links, affiliate links – link cloaking and management +1 moreAffiliate Links: WordPress Plugin for Link Cloaking and Link Management <= 3.0.1 - Missing Authorization to Unauthenticated Import/Export and PHP Object Injection8.1 High
- s2member, wp sharks s2member pro +1 mores2Member Pro <= 241216 - Unauthenticated PHP Object Injection9.8 Critical
- apache eventmeshApache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code execution9.8 Critical
- apache igniteApache Ignite: Possible RCE when deserializing incoming messages by the server node9.5 Critical
- themerex puzzles, puzzles | wp magazine / review with store wordpress theme + rtl +1 morePuzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 - Unauthenticated PHP Object Injection8.1 High
- dayrui xunruicmsdayrui XunRuiCMS Api.php deserialization5.3 Medium
- dayrui xunruicmsdayrui XunRuiCMS Linkage.php import_add deserialization5.3 Medium
- wazuh, wazuh server +1 moreRemote code execution in Wazuh server9.9 Critical
- taisan tarzan-cmstaisan tarzan-cms Add Theme admin#themes upload deserialization5.3 Medium
- puppetpu puppet agentDeserialization of untrusted data6.6 Medium
- soflyy wp all import pro, wp all import +1 moreWP All Import Pro <= 4.9.7 - Authenticated (Administrator+) PHP Object Injection via Import File7.2 High
- ibl software engineering aero weather, namis, satellite weather +1 more +3 moreRemote Code Execution vulnerability in IBL Software Engineering Visual Weather and derived products (NAMIS, Aero Weather, Satellite Weather)9.5 Critical
- trimble cityworks, cityworks (with office companion) +1 moreTrimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to...8.6 High
- cisco identity services engine, identity services engine software, ise passive identity connector +2 moreCisco Identity Services Engine Java Deserialization Vulnerability9.9 Critical
- magepeople inc. taxi booking manager for woocommerceWordPress Taxi Booking Manager for WooCommerce plugin <= 1.1.8 - PHP Object Injection vulnerability8.8 High
- maxd lightning moduleMaxD Lightning Module deserialization2.3 Low
- icontrolwpiControlWP – Multiple WordPress Site Manager <= 4.4.5 - Unauthenticated PHP Object Injection9.8 Critical
- aridius xyzAridius XYZ News loadMore deserialization6.9 Medium
- snowflake connector, snowflakedb snowflake-connector-python +1 moreThe Snowflake Connector for Python uses insecure deserialization of the OCSP response cache6.7 Medium
- cvat computer vision annotation tool, cvat-ai cvat +1 moreCVAT allows remote code execution via tracker Nuclio functions8.7 High
- nvidia rapids cudf and cumlNVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a...6.8 Medium
- ruoyiy_project RuoYi Whitelist getBeanName deserialization5.1 Medium
- vllmvLLM allows a malicious model RCE by torch.load in hf_model_weights_iterator7.5 High
- pdfcrowd dev team save as pdfWordPress Save as PDF Plugin by Pdfcrowd Plugin <= 4.4.0 - PHP Object Injection vulnerability9.8 Critical
- thimpress fundpressWordPress FundPress plugin <= 2.0.6 - PHP Object Injection vulnerability9.8 Critical
- skyverge custom product tabs lite for woocommerceCustom Product Tabs Lite for WooCommerce <= 1.9.0 - Authenticated (Shop Manager+) PHP Object Injection7.2 High
- sonicwall sma1000, sma1000 appliances, sma6200 firmware +7 more +9 morePre-authentication deserialization of untrusted data vulnerability has been identified in the...9.8 Critical
- ibm sterling b2b integrator standard edition, sterling b2b integrator +1 moreIBM Sterling B2B Integrator Standard Edition code execution8.8 High
- muzaara google ads report, notfound muzaara google ads report +1 moreWordPress Muzaara Google Ads Report Plugin <= 3.1 - PHP Object Injection vulnerability9.8 Critical
- bulktheme wooeximWordPress WOOEXIM Plugin <= 5.0.0 - PHP Object Injection vulnerability8.8 High
- marko-m quick countWordPress Quick Count Plugin <= 3.00 - PHP Object Injection vulnerability9.8 Critical
- aipower, senols ai puffer – your ai engine for wordpress (formerly ai power) +1 moreAI Power: Complete AI Pack <= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg_export_ai_forms7.2 High
- Show moreLoading…