CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- mmaitre314 picklescanPicklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.getlincoef Gadget7.6 High
- aizuda snail-jobaizuda snail-job API FurySerializer.deserialize deserialization5.3 Medium
- dromara sa-tokenDromara Sa-Token SaSerializerTemplateForJdkUseBase64.java ObjectInputStream.readObject deserialization2.3 Low
- mmaitre314 picklescanpicklescan - Undetected Remote Code Execution via numpy.f2py.crackfortran.param_eval7.6 High
- mmaitre314 picklescanpicklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.myeval Detection Bypass7.6 High
- mmaitre314 picklescanpicklescan - Remote Code Execution via operator.methodcaller Detection Bypass7.6 High
- mmaitre314 picklescanpicklescan - Arbitrary Code Execution via Unsafe Deserialization in numpy.f2py.crackfortran7.6 High
picklescanPyPIPicklescan missing detection when calling pty.spawn8.9 High- mmaitre314 picklescanpicklescan - Arbitrary File Writing via distutils Module Bypass9.3 Critical
- dromara sa-tokenDromara Sa-Token SaJdkSerializer.java ObjectInputStream.readObject deserialization2.3 Low
- internlm lmdeploylmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load()8.8 High
- icegram express proWordPress Icegram Express Pro plugin < 5.9.14 - PHP Object Injection vulnerability7.2 High
- tencent facedetection-dsfdTencent FaceDetection-DSFD resnet Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- tencent tfaceTencent TFace restore_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- tencent tfaceTencent TFace eval Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- tencent patrickstarTencent PatrickStar merge_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- tencent neuralnlp-neuralclassifierTencent NeuralNLP-NeuralClassifier _load_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- tencent mimicmotionTencent MimicMotion create_pipeline Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- tencent medicalnetTencent MedicalNet generate_model Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- tencent hunyuanvideoTencent HunyuanVideo load_vae Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- tencent hunyuanditTencent HunyuanDiT model_resume Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- tencent hunyuanditTencent HunyuanDiT merge Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- tencent hunyuan3d-1Tencent Hunyuan3D-1 load_pretrained Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- hugging face accelerateHugging Face Accelerate Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- hugging face diffusersHugging Face Diffusers CogView4 Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- hugging face smolagentsHugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability10.0 Critical
- hugging face transformersHugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- hugging face transformersHugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- hugging face transformersHugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- hugging face transformersHugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- hugging face transformersHugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- langchain langchain.js, langchain\/core, langchain-ai langchainjs +2 moreLangChain serialization injection vulnerability enables secret extraction8.6 High
- langchain-ai langchain, langchain core +1 moreLangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs9.3 Critical
- livecomposer live composer – free wordpress website builderLive Composer – Free WordPress Website Builder <= 2.0.2 - Authenticated (Contributor+) PHP Object Injection via dslc_module_posts_output Shortcode7.5 High
- pluginsglpi databaseinventoryGLPI Database Inventory Plugin Vulnerable to Stored Object Injection6.4 Medium
- apache nifiApache NiFi: Deserialization of Untrusted Data in GetAsanaObject Processor7.5 High
- genymobile scrcpyGenymobile/scrcpy <= 3.3.3 Global Buffer Overflow6.9 Medium
- magepeopleteam booking and rental managerWordPress Booking and Rental Manager plugin <= 2.5.4 - PHP Object Injection vulnerability8.8 High
- boldthemes codiqaWordPress Codiqa theme < 1.2.8 - PHP Object Injection vulnerability9.8 Critical
- boldgrid client invoicing by sprout invoicesWordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - PHP Object Injection vulnerability9.8 Critical
- tielabs jannahWordPress Jannah theme <= 7.6.0 - PHP Object Injection vulnerability9.8 Critical
- crm perks wp gravity forms salesforceWordPress WP Gravity Forms Salesforce plugin <= 1.5.1 - PHP Object Injection vulnerability9.8 Critical
- crm perks wp gravity forms hubspotWordPress WP Gravity Forms HubSpot plugin <= 1.2.6 - Deserialization of untrusted data vulnerability9.8 Critical
- crm perks wp gravity forms constant contact pluginWordPress WP Gravity Forms Constant Contact plugin plugin <= 1.1.2 - Deserialization of untrusted data vulnerability9.8 Critical
- crm perks wp gravity forms zoho crm and biginWordPress WP Gravity Forms Zoho CRM and Bigin plugin <= 1.2.9 - Deserialization of untrusted data vulnerability9.8 Critical
- crm perks wp gravity forms insightlyWordPress WP Gravity Forms Insightly plugin <= 1.1.6 - Deserialization of untrusted data vulnerability9.8 Critical
- crm perks wp gravity forms freshdesk pluginWordPress WP Gravity Forms FreshDesk plugin plugin <= 1.3.5 - Deserialization of untrusted data vulnerability9.8 Critical
- add-ons.org pdf for elementor forms + drag and drop template builderWordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 6.5.0 - PHP Object Injection vulnerability8.8 High
- add-ons.org pdf invoice builder for woocommerceWordPress PDF Invoice Builder for WooCommerce plugin <= 6.5.0 - Deserialization of untrusted data vulnerability8.8 High
- add-ons.org pdf for wpformsWordPress PDF for WPForms plugin <= 6.5.0 - Deserialization of untrusted data vulnerability8.8 High
- Show moreLoading…