CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- mahmudul hasan arif fluentboardsWordPress FluentBoards plugin <= 1.47 - PHP Object Injection Vulnerability9.8 Critical
- bdthemes ultimate store kit elementor addonsWordPress Ultimate Store Kit Elementor Addons plugin <= 2.4.0 - Deserialization of untrusted data Vulnerability9.8 Critical
- melapress login securityWordPress MelaPress Login Security plugin <= 2.1.0 - PHP Object Injection Vulnerability6.6 Medium
- lm-sys fastchatlm-sys fastchat apply_delta.py apply_delta_low_cpu_mem deserialization4.8 Medium
- kagla gnucommerceWordPress GNUCommerce plugin <= 1.5.4 - PHP Object Injection vulnerability9.8 Critical
- xorbits inferenceXorbits Inference model.py load deserialization5.1 Medium
- adianti frameworkAdianti Framework deserialization5.3 Medium
- subnet solutions powersystem center 2020Subnet Solutions PowerSYSTEM Center Deserialization of Untrusted Data6.9 Medium
- wpeverest everest forms, everest forms – contact form, payment form, quiz, survey & custom form builder +1 moreEverest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress <= 3.1.1 - Unauthenticated PHP Object Injection9.8 Critical
- open, inc. bizrobo!Deserialization of untrusted data issue exists in BizRobo! all versions. If this vulnerability is...8.8 High
- magepeopleteam wpbookinglyWordPress WpBookingly plugin <= 1.3.0 - PHP Object Injection vulnerability9.8 Critical
- realmag777 tableonWordPress TableOn plugin <= 1.0.4.3 - PHP Object Injection vulnerability9.8 Critical
- empik empikplace for woocommerceWordPress EmpikPlace for Woocommerce Plugin <= 1.4.3 - PHP Object Injection vulnerability9.8 Critical
- pickplugins job board managerWordPress Job Board Manager Plugin <= 2.1.61 - PHP Object Injection vulnerability8.8 High
- pickplugins accordionWordPress Accordion plugin <= 2.3.11 - PHP Object Injection vulnerability8.8 High
- magepeopleteam wpeventlyWordPress WpEvently plugin <= 4.3.6 - PHP Object Injection vulnerability8.8 High
- bentomlInsecure Deserialization leads to RCE in BentoML's runner server9.8 Critical
- adobe coldfusionColdFusion | Deserialization of Untrusted Data (CWE-502)8.4 High
- adobe coldfusionColdFusion | Deserialization of Untrusted Data (CWE-502)9.1 Critical
- adobe coldfusionColdFusion | Deserialization of Untrusted Data (CWE-502)8.4 High
- microsoft sharepoint enterprise server 2016, sharepoint server 2019, sharepoint server subscription edition +2 more +4 moreMicrosoft SharePoint Remote Code Execution Vulnerability7.2 High
- opplus springboot-adminopplus springboot-admin SysGeneratorController.java code deserialization5.3 Medium
- mmaitre314 picklescanPicklescan - Arbitrary Code Execution via Unsafe Numpy Function Detection Bypass7.6 High
- philips intellispace portalUnauthenticated Remote Code Execution via .NET Deserialization7.3 High
- red hat jboss enterprise application platform 7, jboss enterprise application platform 7.4 for rhel 8, jboss enterprise application platform 7.4 for rhel 9 +5 more +7 moreOrg.jboss.eap:wildfly-ejb3: improper deserialization in jboss marshalling allows remote code execution6.2 Medium
- huawei emui, harmonyos +1 moreDeserialization mismatch vulnerability in the DSoftBus module Impact: Successful exploitation of...8.4 High
- eladminelunez eladmin Maintenance Management Module testConnect deserialization5.3 Medium
- bentomlBentoML Allows Remote Code Execution (RCE) via Insecure Deserialization9.8 Critical
- bitdefender gravityzone, gravityzone console +1 moreInsecure PHP deserialization issue in GravityZone Console (VA-12634)9.5 Critical
- thu-pacman chituthu-pacman chitu backend.py torch.load deserialization4.8 Medium
- internlm lmdeployInternLM LMDeploy PT File utils.py load_weight_ckpt deserialization4.8 Medium
- pickplugins testimonial sliderWordPress Testimonial Slider plugin <= 2.0.13 - PHP Object Injection vulnerability8.8 High
- open source robotics foundation robot operating system (ros), openrobotics robot operating system +1 moreUse of unsafe yaml load in dynparam7.8 High
- sabuj kundu cbx pollWordPress CBX Poll plugin <= 2.0.4 - PHP Object Injection vulnerability9.8 Critical
- magepeopleteam wptravellyWordPress WpTravelly Plugin <= 1.8.7 - PHP Object Injection vulnerability8.8 High
- nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization...6.3 Medium
- apache parquet javaApache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata10.0 Critical
- silverplugins217 multiple shipping and billing address for woocommerceWordPress Multiple Shipping And Billing Address For Woocommerce plugin <= 1.5 - PHP Object Injection Vulnerability9.8 Critical
- sunshinephotocart sunshine photo cartWordPress Sunshine Photo Cart plugin <= 3.4.10 - PHP Object Injection Vulnerability9.8 Critical
- mdjm mobile dj managerWordPress MDJM Event Management plugin <= 1.7.5.2 - PHP Object Injection vulnerability8.8 High
- jooby-project joobyjooby-pac4j: deserialization of untrusted data8.8 High
- appleple a-blog cms, appleple inc. a-blog cms (ver. 2.8.x series), a-blog cms (ver.2.10.x series) +4 more +6 moreUntrusted data deserialization vulnerability exists in a-blog cms. Processing a specially crafted...7.5 High
- mywebtonet php/mysql cpu performance statisticsWordPress PHP/MySQL CPU performance statistics Plugin <= 1.2.1 - PHP Object Injection vulnerability9.8 Critical
- glenwpcoder drag and drop multiple file upload for contact form 7, codedropz drag and drop multiple file upload - contact form 7 +1 moreDrag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated PHP Object Injection via PHAR to Arbitrary File Deletion7.5 High
- hclsoftware travelerWordPress Traveler theme <= 3.1.8 - PHP Object Injection vulnerability9.0 Critical
- eladminelunez eladmin upload checkFile deserialization5.1 Medium
- cozmoslabs translatepressWordPress TranslatePress plugin <= 2.9.6 - PHP Object Injection Vulnerability7.2 High
- smackcoders export all posts, products, orders, refunds & usersExport All Posts, Products, Orders, Refunds & Users <= 2.13 - Unauthenticated PHP Object Injection9.8 Critical
- webtoffee product import export for woocommerce – import export product csv suite, product import export for woocommerce +1 moreProduct Import Export for WooCommerce <= 2.5.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter7.2 High
- wordpressdotorg wordpress importerWordPress Importer <= 0.8.3 - Authenticated (Administrator+) PHP Object Injection7.2 High
- Show moreLoading…