CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- designthemes single propertyWordPress Single Property theme <= 2.8 - PHP Object Injection vulnerability8.8 High
- quantumcloud kbx pro ultimateWordPress KBx Pro Ultimate plugin <= 8.0.5 - PHP Object Injection vulnerability9.8 Critical
- designthemes knowledge baseWordPress Knowledge Base theme <= 2.9 - PHP Object Injection vulnerability8.8 High
- axiomthemes white rabbitWordPress White Rabbit theme <= 1.5.2 - PHP Object Injection vulnerability9.8 Critical
- ancorathemes bugspatrolWordPress BugsPatrol theme <= 1.5.0 - PHP Object Injection vulnerability9.8 Critical
- wpshuffle subscribe to downloadWordPress Subscribe to Download plugin <= 2.0.9 - PHP Object Injection vulnerability9.8 Critical
- captivateaudio captivate syncWordPress Captivate Sync Plugin <= 3.0.3 - PHP Object Injection Vulnerability9.8 Critical
- boldthemes addisonWordPress Addison theme < 1.4.8 - PHP Object Injection vulnerability9.8 Critical
- designthemes kriyaWordPress Kriya theme <= 3.4 - PHP Object Injection Vulnerability8.8 High
- boldthemes goldenblattWordPress Goldenblatt theme < 1.3.0 - PHP Object Injection vulnerability9.8 Critical
- whitebox-studio scapeWordPress Scape theme <= 1.5.13 - PHP Object Injection vulnerability9.8 Critical
- designthemes vedaWordPress VEDA Theme <= 4.2 - PHP Object Injection Vulnerability8.8 High
- wpeverest everest forms - frontend listing, everest forms frontend listing +1 moreWordPress Everest Forms - Frontend Listing plugin <= 1.0.5 - PHP Object Injection Vulnerability9.8 Critical
- crm perks connector for gravity forms and google sheetsWordPress Connector for Gravity Forms and Google Sheets plugin <= 1.2.6 - PHP Object Injection vulnerability9.8 Critical
- rascals noisaWordPress Noisa theme <= 2.6.0 - PHP Object Injection vulnerability9.8 Critical
- themesflat tf woo product grid addon for elementorWordPress TF Woo Product Grid Addon For Elementor Plugin <= 1.0.1 - Deserialization of untrusted data Vulnerability9.8 Critical
- hernan villanueva boldermailWordPress Boldermail Plugin <= 2.4.0 - PHP Object Injection Vulnerability8.8 High
- tijmen smit wp store locatorWordPress WP Store Locator plugin <= 2.2.260 - PHP Object Injection vulnerability8.8 High
- wpinstinct woocommerce vehicle parts finderWordPress WooCommerce Vehicle Parts Finder plugin <= 3.7 - PHP Object Injection vulnerability9.8 Critical
- designthemes solar energyWordPress Solar Energy theme <= 3.5 - PHP Object Injection Vulnerability8.8 High
- designthemes insuranceWordPress Insurance theme <= 3.5 - PHP Object Injection Vulnerability8.8 High
- churchcrmChurchCRM setup.php deserialization6.3 Medium
- metagauss registrationmagic, registrationmagic – custom registration forms, user registration, payment, and user login +1 moreRegistrationMagic - Custom Registration Forms <= 3.7.9.2 - PHP Object Injection9.8 Critical
- dan coulter flickr galleryFlickr Gallery <= 1.5.2 - Unauthenticated PHP Object Injection9.8 Critical
- wpmudev appointmentsAppointments <= 2.2.1 - Unauthenticated PHP Object Injection9.8 Critical
- marsupialtail quokkaRemote Code Execution by Pickle Deserialization via FlightServer in pyquokka9.8 Critical
- dataeaseDataEase vulnerable to JDBC URL injection in DB2 and MongoDB data source configuration8.2 High
- dataeaseDataEase vulnerable to remote code execution via H2 JDBC driver bypass8.2 High
- google kerasKeras framework vulnerable to deserialization of untrusted data9.8 Critical
- apache activemq nms amqp, apache software foundation activemq nms amqp client +1 moreApache ActiveMQ NMS AMQP Client: Deserialization of Untrusted Data9.8 Critical
- microsoft windows, windows server 2012, windows server 2012 (server core installation) +11 more +13 moreWindows Server Update Service (WSUS) Remote Code Execution Vulnerability9.8 Critical
- microsoft azure monitor, azure monitor agent +1 moreAzure Monitor Agent Elevation of Privilege Vulnerability7.0 High
- microsoft sharepoint enterprise server 2016, sharepoint server 2019, sharepoint server subscription edition +1 more +3 moreMicrosoft SharePoint Remote Code Execution Vulnerability8.8 High
- ivanti endpoint managerInsecure deserialization in Ivanti Endpoint Manager allows a local authenticated attacker to...7.8 High
- e107e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script. The...6.5 Medium
- newforma project centerNewforma Project Center Server (NPCS) .NET unauthenticated deserialization7.7 High
- newforma project centerNewforma Info Exchange (NIX) .NET unauthenticated deserialization9.3 Critical
scio-pypiPyPIscio is vunerable to Remote Command Execution through PyTorch9.3 Critical- ghostxbh uzy-ssm-mallA fastjson deserialization vulnerability in uzy-ssm-mall v1.1.0 allows attackers to execute...6.5 Medium
- redragon-erpredragon-erp v1.0 was discovered to contain a Shiro deserialization vulnerability caused by the...6.5 Medium
- 5kcrm wukong crmWukongCRM-9.0-JAVA was discovered to contain a fastjson deserialization vulnerability via the ...6.5 Medium
- iliasILIAS Base64 Decoding unserialize deserialization5.3 Medium
- iliasILIAS Test Import unserialize deserialization5.1 Medium
- topal solutions ag finanzbuchhaltungUnauthenticated RCE via .NET Deserialization in Topal Finance Software10.0 Critical
- miguelgrinberg python-socketiopython-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server deployments6.4 Medium
- ibm transformation extender advancedIBM Transformation Extender Advanced code execution9.8 Critical
- lachatterie vergerLaChatterie Verger provider.ts redirectToAuthorization deserialization5.3 Medium
- iterative datachainDataChain: Deserialization of Untrusted Data from Environment Variables2.5 Low
- apache foryApache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyfory9.8 Critical
- pmticket project-management-softwarepmTicket Project-Management-Software Cookie class.database.php loadLanguage deserialization6.9 Medium
- Show moreLoading…