CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- fugue-project fugueFugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer8.8 High
- keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.11 +2 more +4 moreOrg.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federation5.5 Medium
- sigb pmbAn issue in the cms_rest.php component of SIGB PMB v8.0.1.14 allows attackers to execute...9.8 Critical
- jishenghua jsherpAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /serialNumber/addSerialNumber endpoint...9.8 Critical
- jishenghua jsherpAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /role/addcan endpoint is vulnerable to...9.8 Critical
- jishenghua jsherpAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /user/addUser endpoint is vulnerable to...9.8 Critical
- jishenghua jsherpAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /materialCategory/addMaterialCategory...9.8 Critical
- jishenghua jsherpAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /material...9.8 Critical
- cozmoslabs wp webhooksWordPress WP Webhooks plugin <= 3.3.8 - PHP Object Injection vulnerability7.2 High
- icegram email subscribers & newslettersWordPress Email Subscribers & Newsletters plugin <= 5.9.10 - PHP Object Injection vulnerability7.2 High
- microsoft sharepoint onlineMicrosoft SharePoint Online Elevation of Privilege Vulnerability9.8 Critical
- ibm webmethods integrationIBM webMethods Integration Deserialization8.8 High
- vllmVLLM deserialization vulnerability leading to DoS and potential RCE8.8 High
- apache causewayApache Causeway: Java deserialization vulnerability to authenticated attackers6.3 Medium
- smackcoders wp ultimate csv importer – import csv, xml & excel into wordpressWP Import – Ultimate CSV XML Importer for WordPress <= 7.33.1 - Authenticated (Administrator+) PHP Object Injection via CSV Import7.2 High
- modular maxModular Max Serve has Unsafe Deserialization vulnerability8.4 High
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization7.1 High
- drupal, drupal core +1 moreDrupal core - Moderately critical - Gadget chain - SA-CORE-2025-0065.9 Medium
- n-able n-centralN-central windows software probe Remote Code Execution10.0 Critical
- microsoft sharepoint enterprise server 2016, sharepoint server 2019, sharepoint server subscription edition +1 more +3 moreMicrosoft SharePoint Remote Code Execution Vulnerability8.0 High
- kutangguo ktg-mesktg-mes before commit a484f96 (2025-07-03) has a fastjson deserialization vulnerability. This is...6.5 Medium
- kodezen academy lms – wordpress lms plugin for complete elearning solutionAcademy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses'7.2 High
pdfminerDebian,pdfminer-sixPyPI,python-pdfminer.sixopenEuler +2 moreInsecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc6.5 Medium- pdfminer pdfminer.six, debian linux +1 morepdfminer.six vulnerable to Arbitrary Code Execution via Crafted PDF Input8.6 High
- uxper togoWordPress Togo theme < 1.0.4 - PHP Object Injection vulnerability8.8 High
- wp user manager user managerWordPress WP User Manager plugin <= 2.9.12 - PHP Object Injection vulnerability9.8 Critical
- cristián lávaque s2memberWordPress s2Member Plugin <= 250701 - PHP Object Injection Vulnerability9.8 Critical
- crm perks wp gravity forms keap/infusionsoftWordPress WP Gravity Forms Keap/Infusionsoft Plugin <= 1.2.3 - Deserialization of untrusted data Vulnerability9.8 Critical
- sbouey falang multilanguageWordPress Falang multilanguage Plugin <= 1.3.65 - PHP Object Injection Vulnerability8.8 High
- cozmoslabs translatepressWordPress TranslatePress Plugin <= 2.10.2 - Deserialization of untrusted data Vulnerability8.1 High
- nootheme yogi - health beauty & yogaWordPress Yogi - Health Beauty & Yoga Theme <= 2.9.2 - Deserialization of untrusted data Vulnerability8.8 High
- nootheme wemusicWordPress WeMusic Theme <= 1.9.1 - PHP Object Injection Vulnerability8.8 High
- victorthemes seilWordPress Seil Theme <= 1.7.1 - Deserialization of untrusted data Vulnerability9.8 Critical
- fetch designs sign-up sheetsWordPress Sign-up Sheets Plugin <= 2.3.2 - PHP Object Injection Vulnerability9.8 Critical
- scott reilly preserve code formattingWordPress Preserve Code Formatting Plugin <= 4.0.1 - PHP Object Injection Vulnerability8.8 High
- wpdreams ajax search liteWordPress Ajax Search Lite plugin <= 4.13.3 - PHP Object Injection vulnerability5.5 Medium
- dataeaseDataEase is vulnerable to Oracle JNDI Injection8.9 High
- langchain-ai langgraphLangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer7.4 High
- wpeverest everest forms proEverest Forms (Pro) <= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form Signature5.6 Medium
- chouby polylangWordPress Polylang plugin <= 3.7.3 - Deserialization of untrusted data vulnerability8.8 High
- cryptidycryptidy allows code execution via untrusted data due to pickle.loads6.9 Medium
- google kerasVulnerability in Keras Model.load_model Leading to Arbitrary Local File Loading and SSRF5.9 Medium
- taigaio taiga-backTaiga Authenticated Remote Code Execution9.1 Critical
- quequnlong shiyi-blogquequnlong shiyi-blog Job SysJobController.java deserialization5.3 Medium
- bewelcome roxBeWelcome/Rox PHP Object Injection RCE9.4 Critical
- No product listedThe Utils.deserialize function in pgCodeKeeper 10.12.0 processes serialized data from untrusted...8.2 High
- secdev scapyScapy before 2.7.0 Insecure Deserialization RCE via Session Files5.4 Medium
- eyecix jobsearchWordPress JobSearch plugin < 3.0.8 - PHP Object Injection vulnerability9.8 Critical
- acowebs product table for woocommerceWordPress Product Table For WooCommerce plugin <= 1.2.4 - PHP Object Injection vulnerability8.8 High
- universamWordPress UNIVERSAM plugin <= 9.04.02 - PHP Object Injection vulnerability9.8 Critical
- Show moreLoading…