CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- uxper nussWordPress Nuss theme <= 1.3.3 - PHP Object Injection Vulnerability8.8 High
- hiyouga llama-factoryLLaMA-Factory Remote Code Execution (RCE) Vulnerability8.3 High
- ibm websphere application serverIBM WebSphere Application Server code execution9.0 Critical
- kaleris navis n4Deserialization of Untrusted Data in Kaleris Navis N49.3 Critical
- sugarcrmSugarCRM PHP Deserialization RCE9.3 Critical
- upsonicUpsonic Pickle add_tool cloudpickle.loads deserialization5.1 Medium
- powsybl powsybl-corePowSyBl Core allows deserialization of untrusted SparseMatrix data8.1 High
- trendmicro trend micro endpoint encryption, trend micro, inc. micro endpoint encryption policy server +1 moreAn insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could...9.8 Critical
- trendmicro trend micro endpoint encryption, trend micro, inc. micro endpoint encryption policy server +1 moreAn insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could...8.8 High
- trendmicro trend micro endpoint encryption, trend micro, inc. micro endpoint encryption policy server +1 moreAn insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could...9.8 Critical
- trendmicro trend micro endpoint encryption, trend micro, inc. micro endpoint encryption policy server +1 moreAn insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could...9.8 Critical
- trend micro, inc. micro apex central, trendmicro apex central +1 moreAn insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could...9.8 Critical
- trend micro, inc. micro apex central, trendmicro apex central +1 moreAn insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could...9.8 Critical
- yuliaz rapyd payment extension for woocommerceWordPress Rapyd Payment Extension for WooCommerce plugin <= 1.2.0 - PHP Object Injection Vulnerability9.8 Critical
- themeton spareWordPress Spare <= 1.7 - PHP Object Injection Vulnerability9.8 Critical
- crm perks integration for contact form 7 and zoho crm, biginWordPress Integration for Contact Form 7 and Zoho CRM, Bigin plugin <= 1.3.0 - PHP Object Injection Vulnerability9.8 Critical
- implecode ecommerce product catalogWordPress eCommerce Product Catalog plugin <= 3.4.3 - PHP Object Injection Vulnerability7.2 High
- dell controlvault3, controlvault3 plus, broadcom bcm5820x +2 moreDell ControlVault3/ControlVault3 Plus deserialization of untrusted input vulnerability8.1 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +2 more +4 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +2 more +4 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.8 High
- clickandpledge wordpress-wpjobboardWordPress WordPress-WPJobBoard <= 25.07010000-WP6.8.1-JB5.11.5 - SQL Injection Vulnerability9.3 Critical
- loftocean cozystayWordPress CozyStay theme < 1.7.1 - PHP Object Injection vulnerability9.8 Critical
- apache kafkaApache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration7.5 High
- apache kafkaApache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration8.8 High
- themeton the fashion - model agency one page beauty themeWordPress The Fashion - Model Agency One Page Beauty Theme plugin <= 1.4.4 - Deserialization of untrusted data Vulnerability9.8 Critical
- themeton pimp - creative multipurposeWordPress PIMP - Creative MultiPurpose <= 1.7 - Deserialization of untrusted data Vulnerability9.8 Critical
- themeton flap - business wordpress themeWordPress FLAP - Business WordPress Theme <= 1.5 - PHP Object Injection Vulnerability9.8 Critical
- themeton pressgrid - frontend publish reaction & multimedia themeWordPress PressGrid - Frontend Publish Reaction & Multimedia Theme <= 1.3.1 - Deserialization of untrusted data Vulnerability9.8 Critical
- kafbat kafka-uiKafbat UI vulnerable to Remote Code Execution by JMX in Metrices Configuration8.9 High
auth0/loginPackagistlaravel-auth0 SDK Deserialization of Untrusted Data vulnerability9.3 Critical- apache inlongApache InLong: An arbitrary file read vulnerability for JDBC9.8 Critical
- ancorathemes mr. murphyWordPress Mr. Murphy < 1.2.12.1 - PHP Object Injection Vulnerability9.8 Critical
- axiomthemes sweet dessertWordPress Sweet Dessert < 1.1.13 - PHP Object Injection Vulnerability9.8 Critical
- teastudio.pl wp posts carouselWordPress WP Posts Carousel <= 1.3.12 - PHP Object Injection Vulnerability8.8 High
- themegoods photographyWordPress Photography theme <= 7.5.2 - PHP Object Injection vulnerability8.5 High
- soar cloud system co., ltd. hrd human resource management system, scshr hr portal +1 moreSoar Cloud HRD Human Resource Management System - Deserialization of Untrusted Data9.9 Critical
auth0/symfonyPackagistAuth0 Symfony SDK Deserialization of Untrusted Data vulnerability9.3 Critical- shenzhen dashi tongzhou information technology agilebpmShenzhen Dashi Tongzhou Information Technology AgileBPM Groovy Script SysScriptController.java executeScript deserialization5.3 Medium
- shenzhen dashi tongzhou information technology agilebpmShenzhen Dashi Tongzhou Information Technology AgileBPM SysToolsController.java parseStrByFreeMarker deserialization5.3 Medium
auth0/wordpressPackagistAuth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data9.3 Critical- cisco unified contact center expressCisco Unified Contact Center Express Remote Code Execution Vulnerability3.8 Low
- cisco unified contact center expressCisco Unified Contact Center Express Editor Remote Code Execution Vulnerability5.3 Medium
- 1000mz chestnutcmsChestnutCMS API Endpoint exec deserialization5.3 Medium
- auth0 auth0-phpAuth0-PHP SDK Deserialization of Untrusted Data vulnerability9.3 Critical
- phpwcmsslackero phpwcms image_resized.php getimagesize deserialization6.9 Medium
- phpwcmsslackero phpwcms Custom Source Tab cnt21.readform.inc.php is_file deserialization5.1 Medium
- phpwcmsslackero phpwcms Feedimport processing.inc.php deserialization5.3 Medium
- techjewel ninja tables – easy data table builder, wpmanageninja ninja tables +1 moreNinja Tables – Easy Data Table Builder <= 5.0.18 - Unauthenticated PHP Object Injection to Limited Remote Code Execution5.6 Medium
- 3ds delmia aprisoDeserialization of Untrusted Data vulnerability affecting DELMIA Apriso from Release 2020 through Release 20259.0 Critical
- bulwarkmail webmail, debian linux +1 moreRoundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization9.9 Critical
- Show moreLoading…