CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- google androidIn createIntentsList of PackageParser.java , there is a possible way to bypass lazy bundle...7.8 High
- zhilink adp application developer platform, zhilink 智互联(深圳)科技有限公司 adp application developer platform 应用开发者平台 +1 morezhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 verifyToken deserialization5.3 Medium
- thimpress course builderWordPress Course Builder < 3.6.6 - PHP Object Injection Vulnerability9.8 Critical
- freescoutFreeScout Vulnerable to Deserialization of Untrusted Data8.6 High
- vercel next.jsInformation exposure in Next.js dev server due to lack of origin verification2.3 Low
- apache inlongApache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read9.1 Critical
- apache inlongApache InLong: JDBC Vulnerability For URLEncode and backspace bypass6.5 Medium
- apache inlongApache InLong: JDBC Vulnerability during verification processing6.5 Medium
- erdogant pypickleerdogant pypickle pypickle.py load deserialization4.8 Medium
- humansignal label-studio-ml-backend, label studio ml backend +1 moreHumanSignal label-studio-ml-backend PT File neural_nets.py load deserialization4.8 Medium
- funaudiollm inspiremusicFunAudioLLM InspireMusic Pickle Data model.py load_state_dict deserialization4.8 Medium
- easycorp zentao, easysoft zentaopms +1 moreeasysoft zentaopms Editor index.php edit deserialization5.3 Medium
- themeton dashWordPress Dash <= 1.3 - PHP Object Injection Vulnerability9.8 Critical
- themeton hotstar – multi-purpose business themeWordPress HotStar – Multi-Purpose Business Theme <= 1.4 - PHP Object Injection Vulnerability9.8 Critical
- themeton the businessWordPress The Business <= 1.6.1 - PHP Object Injection Vulnerability9.8 Critical
- ancorathemes umbertoWordPress Umberto theme <= 1.2.8 - PHP Object Injection Vulnerability9.8 Critical
- ancorathemes fish houseWordPress Fish House theme <= 1.2.7 - PHP Object Injection Vulnerability9.8 Critical
- designthemes crafts & artsWordPress Crafts & Arts theme <= 2.5 - PHP Object Injection Vulnerability8.8 High
- designthemes pet worldWordPress Pet World theme <= 2.8 - PHP Object Injection Vulnerability8.8 High
- themeton acerolaWordPress Acerola <= 1.6.5 - PHP Object Injection Vulnerability9.8 Critical
- ancorathemes jarvis – night club, concert, festival wordpressWordPress Jarvis – Night Club, Concert, Festival WordPress theme <= 1.8.11 - PHP Object Injection Vulnerability9.8 Critical
- designthemes finance consultantWordPress Finance Consultant theme <= 2.8 - PHP Object Injection Vulnerability8.8 High
- themegoods grand tourWordPress GrandTour theme <= 5.6 - PHP Object Injection vulnerability9.8 Critical
- thememakers car dealerWordPress Car Dealer theme < 1.6.8 - PHP Object Injection vulnerability9.8 Critical
- boldthemes medicareWordPress Medicare Theme <= 2.1.0 - PHP Object Injection vulnerability9.8 Critical
- boldthemes avantageWordPress Avantage Theme <= 2.4.9 - PHP Object Injection vulnerability9.8 Critical
- goodlayers hostelWordPress Goodlayers Hostel Plugin <= 3.1.2 - PHP Object Injection vulnerability9.8 Critical
- goodlayers hotelWordPress Goodlayers Hotel plugin <= 3.1.4 - PHP Object Injection vulnerability9.8 Critical
- coinpayments coinpayments.net payment gateway for woocommerceWordPress CoinPayments.net Payment Gateway for WooCommerce plugin <= 1.0.17 - PHP Object Injection Vulnerability9.8 Critical
- wpfunnelsWordPress WPFunnels plugin <= 3.5.18 - PHP Object Injection Vulnerability9.8 Critical
- digitalzoomstudio zoomsoundsWordPress ZoomSounds plugin <= 6.91 - PHP Object Injection vulnerability9.8 Critical
- codexpert, inc wc affiliateWordPress WC Affiliate plugin <= 2.16 - PHP Object Injection vulnerability8.8 High
- ancorathemes kids planetWordPress Kids Planet theme <= 2.2.14 - PHP Object Injection Vulnerability9.8 Critical
- pagaleve pix 4x sem juros - pagaleveWordPress Pix 4x sem juros - Pagaleve plugin <= 1.6.9 - PHP Object Injection Vulnerability9.8 Critical
- steinrein glossary by wppedia – best glossary plugin for wordpressGlossary by WPPedia <= 1.3.0 - Authenticated (Administrator+) PHP Object Injection7.2 High
- typo3 sr feuser register extensionThe Front End User Registration extension for TYPO3 (sr_feuser_register) Remote Code Execution10.0 Critical
- vllmvLLM Allows Remote Code Execution via PyNcclPipe Communication Service9.8 Critical
- schweitzer engineering laboratories sel-5030 acselerator quickset softwareDeserialization of Untrusted Data7.5 High
- chimpgroup foodbakeryWordPress FoodBakery plugin <= 3.3 - PHP Object Injection vulnerability9.8 Critical
- themegoods altairWordPress Altair theme <= 5.2.2 - PHP Object Injection vulnerability9.8 Critical
- themegoods grand restaurantWordPress Grand Restaurant WordPress theme <= 7.0 - PHP Object Injection vulnerability9.8 Critical
- potenzaglobalsolutions ciyashopWordPress CiyaShop theme <= 4.18.0 - PHP Object Injection vulnerability9.8 Critical
- themegoods grand conferenceWordPress Grand Conference theme <= 5.3 - PHP Object Injection vulnerability9.8 Critical
- chimpstudio foodbakery sticky cartWordPress Foodbakery Sticky Cart plugin <= 3.2 - PHP Object Injection vulnerability9.8 Critical
- themegusta smart sections theme builder - wpbakery page builder addonWordPress Smart Sections Theme Builder - WPBakery Page Builder Addon plugin <= 1.7.8 - PHP Object Injection vulnerability9.8 Critical
- elbisnero wordpress events calendar registration & ticketsWordPress WordPress Events Calendar Registration & Tickets plugin <= 2.6.0 - PHP Object Injection vulnerability9.8 Critical
- quantumcloud wpbot pro wordpress chatbotWordPress WPBot Pro Wordpress Chatbot <= 12.7.0 - PHP Object Injection Vulnerability9.8 Critical
- iop-apl-uw basestation3, washington basestation +1 moreiop-apl-uw basestation3 QC.py load_qc_pickl deserialization4.8 Medium
- shapedplugin wp tabsWordPress WP Tabs plugin <= 2.2.12 - PHP Object Injection Vulnerability7.2 High
- xu-yijie grpo-flatXU-YIJIE grpo-flat grpo_vanilla.py main deserialization4.8 Medium
- Show moreLoading…