CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- axiomthemes cars4rentWordPress Cars4Rent Theme <= 1.4.2 - PHP Object Injection Vulnerability9.8 Critical
- max chirkov simple login logWordPress Simple Login Log plugin <= 1.1.3 - PHP Object Injection vulnerability8.1 High
- themerex organic beautyWordPress Organic Beauty Theme <= 1.4.6 - PHP Object Injection Vulnerability9.8 Critical
- thememakers visual content composerWordPress ThemeMakers Visual Content Composer Plugin <= 1.5.8 - PHP Object Injection Vulnerability9.8 Critical
- rascals noisaWordPress Noisa theme <= 2.6.0 - PHP Object Injection Vulnerability8.8 High
- pickplugins post grid and gutenberg blocksWordPress Post Grid and Gutenberg Blocks Plugin <= 2.3.11 - PHP Object Injection Vulnerability8.8 High
- info@welcart welcart e-commerceWordPress Welcart e-Commerce Plugin <= 2.11.16 - PHP Object Injection Vulnerability7.2 High
- quanticalabs medicenter - health medical clinicWordPress MediCenter - Health Medical Clinic <= 15.1 - PHP Object Injection Vulnerability9.8 Critical
- adrian tobey groundhoggWordPress Groundhogg plugin <= 4.2.2 - PHP Object Injection vulnerability6.6 Medium
- themeisle redirection for contact form 7Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection via PHAR Deserialization7.5 High
- themeisle redirection for contact form 7Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection8.8 High
- n-able n-centralInsecure Deserialization Vulnerability9.4 Critical
- jeecg jimureportjeecgboot JimuReport Data Large Screen Template testConnection deserialization5.3 Medium
- scriptsbundle exertioWordPress Exertio Theme <= 1.3.2 - PHP Object Injection Vulnerability9.8 Critical
- keywordrush content eggWordPress Content Egg plugin <= 7.0.0 - PHP Object Injection Vulnerability7.2 High
- arraytics eventinWordPress Eventin Plugin <= 4.0.31 - PHP Object Injection Vulnerability8.8 High
- nvidia nemo, nemo framework +1 moreNVIDIA NeMo Framework for all platforms contains a vulnerability where a user could cause a...7.8 High
- palo alto networks checkov by prisma cloudCheckov by Prisma Cloud: Unsafe Deserialization of Terraform Files Allows Code Execution4.8 Medium
- hyland software onbaseHyland OnBase < 17.0.2.87 .NET Remoting TCP Channel Unauthenticated RCE10.0 Critical
- crmperks database for contact form 7, wpforms, elementor formsDatabase for Contact Form 7, WPforms, Elementor forms <= 1.4.3 - Unauthenticated PHP Object Injection to Arbitrary File Deletion9.8 Critical
- microsoft sharepoint enterprise server 2016, sharepoint server 2019, sharepoint server +2 moreMicrosoft SharePoint Remote Code Execution Vulnerability8.8 High
- microsoft web deploy 4.0Web Deploy Remote Code Execution Vulnerability8.8 High
- kanboardKanboard Authenticated Admin Remote Code Execution via Unsafe Deserialization of Events9.1 Critical
- siemens simatic s7-plcsim v17, simatic step 7 v17, simatic step 7 v18 +30 more +32 moreA vulnerability has been identified in SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 V17 ...8.5 High
- siemens simatic pcs neo v4.1, simatic pcs neo v5.0, simatic pcs neo v6.0 +34 more +36 moreA vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 ...8.6 High
- mmaitre314 picklescanpicklescan - Detection Bypass via STACK_GLOBAL Opcode Parsing Logic Flaw9.3 Critical
- google kerasKeras safe_mode bypass allows arbitrary code execution when loading a malicious model.8.6 High
- codefuse modelcacheModelCache for LLM through v0.2.0 was discovered to contain an deserialization vulnerability via...9.8 Critical
- apache seata, apache software foundation seata (incubating) +1 moreApache Seata (incubating): Deserialization of untrusted Data in Apache Seata Server9.8 Critical
- antabot white-jotterAntabot White-Jotter com.gm.wj.config.ShiroConfiguration ShiroConfiguration.java CookieRememberMeManager deserialization2.3 Low
- skops-dev skopsskops: Card.get_model does not block arbitrary code execution8.4 High
- tae898 ercERC (aka Emotion Recognition in Conversation) through 0.3 has insecure deserialization via a...5.7 Medium
- huawei harmonyosParcelMismatch vulnerability in attribute deserialization. Impact: Successful exploitation of...5.5 Medium
- huawei harmonyosParcelMismatch vulnerability in attribute deserialization. Impact: Successful exploitation of...5.5 Medium
- huawei harmonyosIssue of inconsistent read/write serialization in the ad module. Impact: Successful exploitation...5.5 Medium
- huawei harmonyosDeserialization vulnerability of untrusted data in the ability module. Impact: Successful...5.5 Medium
- No product listedThe modelscope/ms-swift library thru 2.6.1 is vulnerable to arbitrary code execution through...9.8 Critical
ms-swiftPyPIMS SWIFT Deserialization RCE Vulnerability6.6 Mediumms-swiftPyPIMS SWIFT Remote Code Execution via unsafe PyYAML deserialization9.8 Critical- absolute secure accessData deserialization vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.567.0 High
- prestashopA PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0 allows...6.5 Medium
- prestashopA PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows...6.5 Medium
- samsung electronics data management server, samsung data management server firmware +1 moreDeserialization of Untrusted Data in Samsung DMS(Data Management Server) allows attackers to...8.0 High
- chancmsyanyutao0402 ChanCMS collect.js getArticle deserialization5.3 Medium
- chancmsyanyutao0402 ChanCMS getArticle deserialization5.3 Medium
- freescoutFreeScout's deserialization of untrusted data leads to Remote Code Execution8.6 High
- solarwinds observability self-hostedSolarWinds Observability Self-Hosted Deserialization of Untrusted Data Local Privilege Escalation Vulnerability7.8 High
- medtronic mycarelink patient monitor 24950, mycarelink patient monitor 24952 +1 moreMedtronic MyCareLink Patient Monitor Deserialization Vulnerability6.5 Medium
- kaltura video platformKaltura < 11.1.0-2 PHP Object Injection RCE9.3 Critical
- hp poly clariti managerPoly Clariti Manager - Multiple Security Vulnerabilities2.0 Low
- Show moreLoading…