CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- beamctrl airianaBeamCtrl Airiana coef deserialization4.8 Medium
- emlogEmlog vulnerable to Deserialization of Untrusted Data6.6 Medium
- vita-mllm freeze-omniVITA-MLLM Freeze-Omni utils.py torch.load deserialization4.8 Medium
- vercel next.jsNext.js Race Condition to Cache Poisoning3.7 Low
- cap-collectifCap Collectif vulnerable to insecure deserialization leading to remote code execution9.5 Critical
- uncannyowl uncanny automator, uncanny automator – easy automation, integration, webhooks & workflow builder plugin +1 moreUncanny Automator <= 6.4.0.1 - Unauthenticated PHP Object Injection in automator_api_decode_message Function9.1 Critical
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability7.4 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability7.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability7.0 High
- sap netweaver, sap se netweaver (visual composer development server) +1 moreInsecure Deserialization in SAP NetWeaver (Visual Composer development server)9.1 Critical
- sap supplier relationship management, sap se supplier relationship management (live auction cockpit) +1 moreMultiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)10.0 Critical
- schweitzer engineering laboratories sel-5033 acselerator rtac softwareDeserialization of Untrusted Data6.6 Medium
- microsoft dataverseMicrosoft Dataverse Remote Code Execution Vulnerability8.7 High
- florent maillefaud wp maintenanceWordPress WP Maintenance plugin <= 6.1.9.7 - PHP Object Injection Vulnerability7.2 High
- mario peshev wp-crm system, wp-crm system +1 moreWordPress WP-CRM System plugin <= 3.4.5 - PHP Object Injection vulnerability7.2 High
- potenza global solutions pgs corePGS Core <= 5.8.0 - Unauthenticated PHP Object Injection9.8 Critical
- vllmRemote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration8.0 High
- rvc-project retrieval-based-voice-conversion-webuiGHSL-2025-022_Retrieval-based-Voice-Conversion-WebUI8.9 High
- rvc-project retrieval-based-voice-conversion-webuiGHSL-2025-021_Retrieval-based-Voice-Conversion-WebUI8.9 High
- rvc-project retrieval-based-voice-conversion-webuiGHSL-2025-020_Retrieval-based-Voice-Conversion-WebUI8.9 High
- rvc-project retrieval-based-voice-conversion-webuiGHSL-2025-019_Retrieval-based-Voice-Conversion-WebUI8.9 High
- rvc-project retrieval-based-voice-conversion-webuiGHSL-2025-018_Retrieval-based-Voice-Conversion-WebUI8.9 High
- rvc-project retrieval-based-voice-conversion-webuiGHSL-2025-017_Retrieval-based-Voice-Conversion-WebUI8.9 High
- rvc-project retrieval-based-voice-conversion-webuiGHSL-2025-016_Retrieval-based-Voice-Conversion-WebUI8.9 High
- zhangyanbo2007 youkefuzhangyanbo2007 youkefu TemplateController.java impsave deserialization5.3 Medium
- nvidia tensorrt-llmNVIDIA TensorRT-LLM for any platform contains a vulnerability in python executor where an...8.8 High
- vllmvLLM Vulnerable to Remote Code Execution via Mooncake Integration10.0 Critical
- gfi mailessentialsGFI MailEssentials < 21.8 MultiNode Insecure Deserialization8.8 High
- gfi mailessentialsGFI MailEssentials < 21.8 Local Privilege Escalation7.8 High
- devexpressDevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on...3.5 Low
- devexpressDevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.3.5 Low
- artbees jupiter x coreJupiter X Core <= 4.8.11 - Unauthenticated PHP Object Injection via PHAR8.1 High
- connectwise screenconnectScreenConnect Exposure to ASP.NET ViewState Code Injection8.1 High
- djjmz social counterWordPress Social Counter plugin <= 2.0.5 - PHP Object Injection Vulnerability7.2 High
- michael cannon flickr shortcode importerWordPress Flickr Shortcode Importer plugin <= 2.2.3 - PHP Object Injection Vulnerability7.2 High
- hiyouga llama-factoryLLaMA-Factory Allows Arbitrary Code Execution via Unsafe Deserialization in Ilamafy_baichuan2.py6.1 Medium
- nvidia nemo, nemo framework +1 moreNVIDIA NeMo Framework contains a vulnerability where a user could cause a deserialization of...7.6 High
- amazon ion dotnetInfinite loop condition in Amazon.IonDotnet8.7 High
- apache activemq nms openwire, apache software foundation activemq nms openwire client +1 moreApache ActiveMQ NMS OpenWire Client: deserialization allowlist bypass9.8 Critical
- linuxfoundation pytorchPyTorch: `torch.load` with `weights_only=True` leads to remote code execution9.3 Critical
- saoshyant1994 saoshyant sliderWordPress Saoshyant Slider Plugin <= 3.0 - PHP Object Injection vulnerability9.8 Critical
- ssvadim ss quizWordPress SS Quiz Plugin <= 2.0.5 - PHP Object Injection vulnerability9.8 Critical
- turitop booking systemWordPress TuriTop Booking System Plugin <= 1.0.10 - PHP Object Injection vulnerability8.8 High
- climax themes kata plusWordPress Kata Plus Plugin <= 1.5.3 - PHP Object Injection vulnerability9.8 Critical
- pickplugins question answerWordPress Question Answer plugin <= 1.2.73 - PHP Object Injection vulnerability8.8 High
- wpwax helpgentWordPress HelpGent plugin <= 2.2.5 - PHP Object Injection vulnerability9.8 Critical
- stylemix ulistingWordPress uListing plugin <= 2.2.0 - Deserialization of untrusted data vulnerability8.8 High
- spwebguy team membersWordPress Team Members plugin <= 3.4.4 - PHP Object Injection Vulnerability8.8 High
- bestweblayout rating by bestwebsoftWordPress Rating by BestWebSoft plugin <= 1.7 - PHP Object Injection Vulnerability8.8 High
- shahjahan jewel fluentcommunityWordPress FluentCommunity plugin <= 1.2.15 - PHP Object Injection Vulnerability9.8 Critical
- Show moreLoading…