CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- add-ons.org pdf for contact form 7WordPress PDF for Contact Form 7 plugin <= 6.5.0 - Deserialization of untrusted data vulnerability8.8 High
- add-ons.org pdf for gravity forms + drag and drop template builderWordPress PDF for Gravity Forms + Drag And Drop Template Builder plugin <= 6.5.0 - PHP Object Injection vulnerability7.5 High
- boldthemes denticareWordPress DentiCare Theme < 1.4.3 - PHP Object Injection Vulnerability9.8 Critical
- sourcefabric phonieboxAn insecure deserialization vulnerability exists in the rss-mp3.php script of the MiczFlor RPi...7.5 High
- tomaszdunia twittodonAn insecure deserialization vulnerability exists in the download.php script of the to3k Twittodon...7.5 High
- nvidia isaac labNVIDIA Isaac Lab contains a deserialization vulnerability. A successful exploit of this...9.0 Critical
- nvidia nemo, nemo framework +1 moreNVIDIA NeMo Framework for all platforms contains a vulnerability where malicious data created by...7.8 High
- nvidia nemo, nemo framework +1 moreNVIDIA NeMo Framework contains a vulnerability in model loading that could allow an attacker to...7.3 High
- trailofbits ficklingFickling has Code Injection vulnerability via pty.spawn()7.1 High
- trailofbits ficklingFickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list7.1 High
- hitachi vantara pentaho data integration and analyticsHitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data8.8 High
- mthreads torch musaMooreThreads torch_musa through all versions contains an unsafe deserialization vulnerability in...9.8 Critical
- tiny-rdm tiny rdmtiny-rdm Tiny RDM Pickle Decoding pickle_convert.go pickle.loads deserialization2.3 Low
- unitecms doubly – cross domain copy paste for wordpressDoubly <= 1.0.46 - Authenticated (Subscriber+) PHP Object Injection via ZIP File Import8.8 High
nextnpm,@rootio/nextRoot +1 moreNext has a Denial of Service with Server Components - Incomplete Fix Follow-Up7.5 High@vitejs/plugin-rscnpmVite Plugin React has a Source Code Exposure Vulnerability in React Server Components5.3 Medium@vitejs/plugin-rscnpmVite Plugin React has a Denial of Service Vulnerability in React Server Components7.5 High- apache hugegraph, apache software foundation hugegraph-server +1 moreApache HugeGraph-Server: RAFT and deserialization vulnerability8.8 High
- rodgerholl visitor logic liteVisitor Logic Lite <= 1.0.3 - Unauthenticated PHP Object Injection via 'lpblocks' Cookie8.1 High
- facebook react, meta react-server-dom-parcel, react-server-dom-turbopack +2 more +4 moreDenial of Service Vulnerability in React Server Components7.5 High
- vercel next.jsNext.js: Unbounded postponed resume buffering can lead to DoS6.9 Medium
- vercel next.jsNext.js: null origin can bypass Server Actions CSRF checks5.3 Medium
- vercel next.jsNext.js: null origin can bypass dev HMR websocket CSRF checks2.3 Low
- vercel next, next.js +1 moreNext.js has Unbounded Memory Consumption via PPR Resume Endpoint5.9 Medium
- vercel next, next.js +1 moreNext.js Vulnerable to Denial of Service with Server Components5.9 Medium
- vercel next.jsNext.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications6.3 Medium
- vercel next.jsNext.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service6.3 Medium
- vercel next.jsNext.js: Unauthenticated Remote Code Execution on windows-hosted servers9.0 Critical
- vercel next.jsNext.js: Response Body Cache Confusion for Requests Containing Bodies6.0 Medium
- vercel next.jsNext.js: Denial of Service in App Router using Server Actions8.2 High
- vercel next.jsNext.js: Cache poisoning via collisions in React Server Component cache-busting3.7 Low
- facebook react, meta react-server-dom-parcel, react-server-dom-turbopack +2 more +4 moreDenial of Service Vulnerability in React Server Components7.5 High
- facebook react, meta react-server-dom-parcel, react-server-dom-turbopack +2 more +4 moreSource Code Exposure Vulnerability in React Server Components5.3 Medium
- barracuda rmmBarracuda RMM < 2025.1.1 Service Center .NET Remoting Deserialization RCE10.0 Critical
- google cloud cloud data fusionArbitrary Code Execution in Google Cloud Data Fusion via Malicious Artifact Upload8.7 High
- adobe coldfusionColdFusion | Deserialization of Untrusted Data (CWE-502)8.4 High
- wearefrank ladybugLadybug has an XMLDecoder Deserialization Vulnerability (Java RCE)7.0 High
- entrust corporation instant financial issuance (if)Entrust Instant Financial Issuance (IFI) Legacy Remoting Service .NET Remoting RCE9.3 Critical
- nvidia nvtabularNVIDIA NVTabular for Linux contains a vulnerability in the Workflow component, where a user could...8.8 High
- nvidia merlin transformers4recNVIDIA Merlin Transformers4Rec for Linux contains a vulnerability in the Trainer component, where...8.8 High
- flipper code - wordpress development company wp mapsWordPress WP Maps plugin <= 4.8.6 - PHP Object Injection vulnerability6.6 Medium
- sap se jconnect - sdk for aseDeserialization Vulnerability in SAP jConnect - SDK for ASE9.1 Critical
- cslanet csla .net, marimerllc csla +1 moreCSLA .NET is vulnerable to Remote Code Execution via WcfProxy7.2 High
- hummerriskHummerRisk thru v1.5.0 is using a vulnerable Snakeyaml component allowing attackers to achieve...8.8 High
- unknown una cmsUNA CMS 9.0.0-RC1 - 14.0.0-RC4 PHP Object Injection9.3 Critical
@vitejs/plugin-rscnpmReact Server Components are Vulnerable to RCE10.0 Critical- facebook react, meta react server components, react-server-dom-parcel +3 more +5 moreReact Server Components are Vulnerable to RCE10.0 Critical
- codesys, codesys development system +1 moreCODESYS Development System - Deserialization of Untrusted Data7.8 High
- nutzam nutzbootnutzam NutzBoot LiteRpc-Serializer HttpServletRpcEndpoint.java getInputStream deserialization6.3 Medium
- favethemes houzezHouzez <= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Search6.3 Medium
- Show moreLoading…