CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- simopro technology winmatrix3Simopro Technology｜WinMatrix3 - Insecure Deserialization9.3 Critical
- metasoft metacrmMetasoft 美特软件 MetaCRM download.jsp AnalyzeParam deserialization5.3 Medium
- microsoft sharepoint, sharepoint server, sharepoint enterprise server 2016 +2 more +4 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability9.8 Critical
- crmperks integration for google sheets and contact form 7, wpforms, elementor, ninja formsIntegration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 - Unauthenticated PHP Object Injection via verify_field_val Function9.8 Critical
- crmperks integration for pipedrive and contact form 7, wpforms, elementor, ninja formsIntegration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.2.3 - Unauthenticated PHP Object Injection via verify_field_val Function9.8 Critical
- sophos intercept x for windowsA local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device...8.8 High
- nootheme yogiWordPress Yogi theme < 2.9.3 - PHP Object Injection Vulnerability8.8 High
- awethemes hillterWordPress Hillter theme <= 3.0.7 - PHP Object Injection Vulnerability8.8 High
- md yeasin ul haider url shortenerWordPress URL Shortener <= 3.0.7 - PHP Object Injection Vulnerability9.8 Critical
- guru team site chat on telegramWordPress Site Chat on Telegram plugin <= 1.0.4 - PHP Object Injection Vulnerability9.8 Critical
- codexpert, inc coschool lmsWordPress CoSchool LMS plugin <= 1.4.3 - PHP Object Injection Vulnerability9.8 Critical
- designthemes visual art | gallery wordpress themeWordPress Visual Art | Gallery WordPress Theme <= 2.4 - PHP Object Injection Vulnerability8.8 High
- jetmonsters jetformbuilderWordPress JetFormBuilder plugin <= 3.5.1.2 - PHP Object Injection Vulnerability7.2 High
- oracle graalvm, oracle corporation graalvm enterprise edition, java se +2 more +4 moreVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE ...5.9 Medium
- rvc-boss gpt-sovits, gpt-sovits-webui +1 moreGHSL-2025-053: GPT-SoVITS Deserialization of Untrusted Data vulnerability8.9 High
- rvc-boss gpt-sovits, gpt-sovits-webui +1 moreGHSL-2025-052: GPT-SoVITS Deserialization of Untrusted Data vulnerability8.9 High
- rvc-boss gpt-sovits, gpt-sovits-webui +1 moreGHSL-2025-051: GPT-SoVITS Deserialization of Untrusted Data vulnerability8.9 High
- rvc-boss gpt-sovits, gpt-sovits-webui +1 moreGHSL-2025-050: GPT-SoVITS Deserialization of Untrusted Data vulnerability8.9 High
- rvc-boss gpt-sovits, gpt-sovits-webui +1 moreGHSL-2025-049: GPT-SoVITS Deserialization of Untrusted Data vulnerability8.9 High
- akirk friendsFriends 3.5.1 - Authenticated (Subscriber+) PHP Object Injection7.5 High
- axis camera station pro, device manager, axis communications ab camera station +2 moreThe communication protocol used between the server process and the service control had a flaw...4.8 Medium
- axis camera station, camera station pro, device manager +2 moreThe communication protocol used between client and server had a flaw that could lead to an...9.0 Critical
- brainstormforce sureforms, sureforms – drag and drop form builder for wordpress +1 moreSureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion7.5 High
- lty628 aidigulty628 Aidigu PHP Object common.php checkUserCookie deserialization6.9 Medium
- adobe experience manager (ms), experience manager +1 moreAdobe Experience Manager (MS) | Deserialization of Untrusted Data (CWE-502)9.8 Critical
- adobe connect, connect desktop application +1 moreAdobe Connect | Deserialization of Untrusted Data (CWE-502)9.6 Critical
- microsoft office, 365 apps, 365 apps for enterprise +6 more +8 moreMicrosoft Office Elevation of Privilege Vulnerability7.8 High
- sap se netweaver enterprise portal federated portal networkInsecure Deserialization in SAP NetWeaver Enterprise Portal Federated Portal Network9.1 Critical
- sap se netweaver (xml data archiving service)Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service)9.1 Critical
- sap se netweaver enterprise portal administrationInsecure Deserialization in SAP NetWeaver Enterprise Portal Administration9.1 Critical
- sap se netweaver application server for java (log viewer )Insecure Deserialization in SAP NetWeaver Application Server for Java (Log Viewer )9.1 Critical
- mescius activereports.netMescius ActiveReports.NET TypeResolutionService Deserialization of Untrusted Data Remote Code Execution Vulnerability9.8 Critical
- mescius activereports.netMescius ActiveReports.NET ReadValue Deserialization of Untrusted Data Remote Code Execution Vulnerability9.8 Critical
- boyuncms project boyuncmsBoyunCMS Installation install2.php deserialization6.3 Medium
- designthemes red artWordPress Red Art theme <= 3.8 - PHP Object Injection Vulnerability8.8 High
- bestwpdeveloper woocommerce product multi-actionWordPress WooCommerce Product Multi-Action plugin <= 1.3 - Deserialization of untrusted data Vulnerability9.8 Critical
- vercel next.jsNext.js DoS vulnerability via cache poisoning7.5 High
- No product listedASNA Assist and ASNA Registrar before 2025-03-31 allow deserialization attacks against .NET...6.5 Medium
- hikvision integrated security management platformHikvision Integrated Security Management Platform Remote Command Execution via applyCT Fastjson10.0 Critical
- themerex education center | lms & online courses wordpress themeEducation Center | LMS & Online Courses WordPress Theme <= 3.6.10 - PHP Object Injection9.8 Critical
- incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 moreForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion7.5 High
- monero project forumMonero Forum Remote Code Execution via Arbitrary File Read and Cookie Forgery10.0 Critical
- delta electronics dtn softFile Parsing Deserialization of Untrusted Data in DTN Soft7.8 High
- delta electronics dtm softFile Parsing Deserialization of Untrusted Data in DTM Soft7.8 High
- apache seata, apache software foundation seata (incubating) +1 moreApache Seata (incubating): Deserialization of untrusted Data in Apache Seata Server9.8 Critical
- akkaakka-cluster-metrics uses Java serialization for cluster metrics6.0 Medium
- pep.vn wp optimize by xtrafficWordPress WP Optimize By xTraffic plugin <= 5.1.6 - PHP Object Injection Vulnerability9.8 Critical
- pebas couponxxlWordPress CouponXxL theme <= 3.0.0 - PHP Object Injection Vulnerability9.8 Critical
- boldthemes amwerkWordPress Amwerk theme <= 1.2.0 - PHP Object Injection Vulnerability9.8 Critical
- uxper salaWordPress Sala theme <= 1.1.3 - PHP Object Injection Vulnerability8.8 High
- Show moreLoading…