CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- digilent dasylabDeserialization of Untrusted Data when parsing a DSB file with Digilent DASYLab8.5 High
- h2oai h2oai/h2o-3Deserialization Vulnerability in h2oai/h2o-39.8 Critical
- solarwinds web help deskSolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability9.8 Critical
- h2oai h2oai/h2o-3Deserialization of Untrusted Data in h2oai/h2o-39.8 Critical
- google androidIn assertSafeToStartCustomActivity of AppRestrictionsFragment.java , there is a possible way to...7.8 High
- vercel next.jsNext.js Affected by Cache Key Confusion for Image Optimization API Routes6.2 Medium
- vercel next.jsNext.js Content Injection Vulnerability for Image Optimization4.3 Medium
- vercel next.jsNext.js Improper Middleware Redirect Handling Leads to SSRF6.5 Medium
- magepeopleteam wpeventlyWordPress WpEvently Plugin <= 4.4.8 - PHP Object Injection Vulnerability8.8 High
- emarket-design wp ticket customer service software & support ticket systemWordPress WP Ticket Customer Service Software & Support Ticket System Plugin <= 6.0.2 - PHP Object Injection Vulnerability8.1 High
- emarket-design employee spotlightWordPress Employee Spotlight Plugin <= 5.1.1 - PHP Object Injection Vulnerability8.1 High
- emarket-design wp easy contactWordPress WP Easy Contact Plugin <= 4.0.1 - PHP Object Injection Vulnerability8.1 High
- emarket-design employee directory – staff listing & team directory plugin for wordpressWordPress Employee Directory – Staff Listing & Team Directory plugin for WordPress plugin <= 4.5.5 - PHP Object Injection vulnerability8.1 High
- manfcarlo wp funnel managerWordPress WP Funnel Manager Plugin <= 1.4.0 - PHP Object Injection Vulnerability9.8 Critical
- h3c group intelligent management center (imc)H3C Intelligent Management Center (iMC) /byod/index.xhtml RCE10.0 Critical
- enituretechnology small package quotes – usps editionWordPress Small Package Quotes – USPS Edition Plugin <= 1.3.9 - PHP Object Injection Vulnerability7.2 High
- mmaitre314 picklescanpicklescan - Arbitrary Code Execution via Undetected asyncio.unix_events._UnixSubprocessTransport._start7.6 High
- mmaitre314 picklescanpicklescan - Arbitrary Code Execution via Undetected cProfile.run in Pickle Deserialization7.6 High
- mmaitre314 picklescanpicklescan - Remote Code Execution via Undetected cProfile.runctx in Pickle Files7.6 High
- mmaitre314 picklescanpicklescan - Arbitrary Code Execution via Undetected doctest.debug_script7.6 High
- mmaitre314 picklescanpicklescan - Remote Code Execution via idlelib.pyshell.ModifiedInterpreter.runcode7.6 High
- mmaitre314 picklescanpicklescan - Arbitrary Code Execution via Undetected idlelib.pyshell.ModifiedInterpreter.runcommand7.6 High
- mmaitre314 picklescanpicklescan - Undetected Remote Code Execution via idlelib.run.Executive.runcode7.6 High
- mmaitre314 picklescanpicklescan - Arbitrary Code Execution via lib2to3.pgen2.pgen.ParserGenerator.make_label Detection Bypass7.6 High
- mmaitre314 picklescanpicklescan - Arbitrary Code Execution via Undetected ensurepip._run_pip Function7.6 High
- mmaitre314 picklescanpicklescan - Arbitrary Code Execution via torch.utils.bottleneck.__main__.run_autograd_prof7.6 High
- mmaitre314 picklescanpicklescan - Remote Code Execution via Undetected idlelib.calltip.get_entity7.6 High
- mmaitre314 picklescanpicklescan - Remote Code Execution via code.InteractiveInterpreter Detection Bypass7.6 High
- mmaitre314 picklescanpicklescan - Arbitrary Code Execution via Undetected idlelib.autocomplete.AutoComplete.fetch_completions7.6 High
- mmaitre314 picklescanpicklescan - Remote Code Execution via idlelib.autocomplete.AutoComplete.get_entity7.6 High
- mmaitre314 picklescanpicklescan - Remote Code Execution via idlelib.debugobj.ObjectTreeItem.SetText7.6 High
- mmaitre314 picklescanpicklescan - Unsafe Deserialization via lib2to3.pgen2.grammar.Grammar.loads7.6 High
- mmaitre314 picklescanpicklescan - Remote Code Execution via Undetected profile.Profile.runctx7.6 High
- mmaitre314 picklescanpicklescan - Arbitrary Code Execution via Undetected profile.Profile.run7.6 High
- mmaitre314 picklescanpicklescan - Arbitrary Code Execution via Undetected trace.Trace.run in Pickle Files7.6 High
- dataeaseDataease DB2 Aspectweaver Deserialization Arbitrary File Write Vulnerability8.2 High
- adminerAdminer PHP Object Injection issue leads to Denial of Service8.6 High
- mmaitre314 picklescanpicklescan - Arbitrary Code Execution via torch.utils._config_module.load_config Bypass7.6 High
- mmaitre314 picklescanpicklescan - Remote Code Execution via torch.jit.unsupported_tensor_ops.execWrapper7.6 High
- mmaitre314 picklescanpicklescan - Unsafe Deserialization via torch.utils.data.datapipes.utils.decoder.basichandlers7.6 High
- mmaitre314 picklescanpicklescan - Undetected Remote Code Execution via torch.utils.collect_env.run7.6 High
- mmaitre314 picklescanpicklescan - Arbitrary Code Execution via torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression7.6 High
- mmaitre314 picklescanpicklescan - Remote Code Execution via torch._dynamo.guards.GuardBuilder.get7.6 High
- mmaitre314 picklescanpicklescan - Arbitrary Code Execution via torch.utils.bottleneck.__main__.run_cprofile7.6 High
- elite project eliteOperaMasks SDK ELite Script Engine v0.5.0 was discovered to contain a deserialization vulnerability.8.8 High
- maharaMahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 deserializes user...9.8 Critical
vllmPyPIvLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder8.8 High- schneider electric ecostruxure™ power monitoring expert (pme), ecostruxure™ power operation (epo) advanced reporting and dashboards module +1 moreCWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code...8.7 High
- osama.esh wp visitor statistics (real time traffic)WordPress WP Visitor Statistics (Real Time Traffic) Plugin <= 8.2 - Cross Site Scripting (XSS) Vulnerability9.8 Critical
- brewlabs sensorpressWordPress SensorPress plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability9.8 Critical
- Show moreLoading…