CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- langflowLangflow Disk Cache Deserialization of Untrusted Data Remote Code Execution Vulnerability7.5 High
- binary-husky gpt academic, gpt academic academic +1 moreGPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability9.8 Critical
- binary-husky gpt academic, gpt academic academic +1 moreGPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability9.8 Critical
- binary-husky gpt academic, gpt academic academic +1 moreGPT Academic stream_daas Deserialization of Untrusted Data Remote Code Execution Vulnerability8.1 High
- deepwisdom metagptFoundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution Vulnerability9.8 Critical
- fuelthemes northWordPress North theme <= 5.7.5 - PHP Object Injection vulnerability8.8 High
- themerex sound | musical instruments online storeWordPress Sound | Musical Instruments Online Store theme <= 1.6.9 - Deserialization of untrusted data vulnerability9.8 Critical
- strongholdthemes tech life cptWordPress Tech Life CPT plugin <= 16.4 - PHP Object Injection vulnerability8.8 High
- strongholdthemes dental care cptWordPress Dental Care CPT plugin < 21.6 - PHP Object Injection vulnerability8.8 High
- designthemes onelifeWordPress OneLife theme <= 3.9 - PHP Object Injection vulnerability8.8 High
- aivahthemes anonaWordPress Anona theme <= 8.0 - PHP Object Injection vulnerability8.8 High
- designthemes vivaghWordPress Vivagh theme <= 2.4 - PHP Object Injection vulnerability8.8 High
- arraytics eventinWordPress Eventin plugin <= 4.1.3 - PHP Object Injection vulnerability8.8 High
- designthemes kids heavenWordPress Kids Heaven theme <= 3.2 - PHP Object Injection vulnerability8.8 High
- themeton consult aidWordPress Consult Aid theme <= 1.4.3 - PHP Object Injection vulnerability9.8 Critical
- artbees jupiterx coreWordPress JupiterX Core plugin <= 4.10.1 - PHP Object Injection vulnerability8.8 High
- docling docling-coreDocling Core vulnerable to Remote Code Execution via unsafe PyYAML usage8.1 High
- tendenciTendenci has Authenticated Remote Code Execution via Pickle Deserialization6.8 Medium
- lxsmnsyc serovalseroval Affected by Remote Code Execution via JSON Deserialization7.5 High
- laravel reverbLaravel Redis Horizontal Scaling Insecure Deserialization9.8 Critical
- posimyththemes nexter extension – security, performance, code snippets & site toolkitNexter Extension – Site Enhancements Toolkit <= 4.4.6 - Unauthenticated PHP Object Injection via 'nxt_unserialize_replace'8.1 High
- typo3 extension "mailqueue"Insecure Deserialization in extension "Mailqueue" (mailqueue)5.2 Medium
- dabeaz ply, red hat fence agents remediation operator, migration toolkit for containers +25 more +27 moreAn undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code...9.8 Critical
- changjetong information technology co., ltd. t+, chanjetvip t\+ +1 moreChangjetong T+ <= 16.x GetStoreWarehouseByStore Deserialization RCE9.3 Critical
- entrust corporation instant financial issuance (if)Entrust Instant Financial Issuance (IFI) SmartCardController Service .NET Remoting RCE9.3 Critical
- made i.t. formsUmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation7.5 High
- microsoft azure core shared client library for python, azure core shared client library +1 moreAzure Core shared client library for Python Remote Code Execution Vulnerability7.5 High
- microsoft sharepoint, sharepoint enterprise server 2016, sharepoint server 2019 +2 more +4 moreMicrosoft SharePoint Remote Code Execution Vulnerability9.8 Critical
- typo3, typo3 cms +1 moreTYPO3 CMS Allows Insecure Deserialization via Mailer File Spool5.2 Medium
- llamaindex, run-llama llama index +1 moreLlamaIndex <= 0.11.6 BGEM3Index Unsafe Deserialization8.4 High
- broadcom dx netops spectrumSpectrum insecure deserialiation2.3 Low
- trailofbits ficklingFickling vulnerable to detection bypass due to "builtins" blindness8.9 High
- trailofbits ficklingFickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist8.9 High
- trailofbits ficklingFickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection8.9 High
- trailofbits ficklingFickling Blocklist Bypass: cProfile.run()8.9 High
- trailofbits ficklingFickling has a bypass via runpy.run_path() and runpy.run_module()8.9 High
- vllm, red hat ai inference server, enterprise linux ai (rhel ai) 3 +1 more +3 morevLLM - Denial of Service via Unvalidated Multimodal Embeddings8.7 High
- tribulant software newslettersWordPress Newsletters plugin <= 4.11 - PHP Object Injection vulnerability9.8 Critical
- open microscopy environment bio-formatsBio-Formats <= 8.3.0 Memoizer Unsafe Deserialization via .bfmemo Cache Files6.8 Medium
- digital zoom studio dzs video galleryWordPress DZS Video Gallery plugin <= 12.37 - PHP Object Injection Vulnerability9.8 Critical
- digital zoom studio dzs video galleryWordPress DZS Video Gallery plugin <= 12.25 - PHP Object Injection vulnerability8.8 High
- themify edminWordPress Themify Edmin theme <= 2.0.0 - PHP Object Injection Vulnerability8.8 High
- milvus-io milvusmilvus HTTP Endpoint expr.go expr.Exec deserialization5.3 Medium
- pluxmlPluXml Media Management medias.php __destruct deserialization5.1 Medium
- feast-dev feast-dev/feast, red hat openshift ai (rhoai), openshift ai 2.25 +2 moreArbitrary Code Execution in feast-dev/feast7.8 High
- fontforgeFontForge SFD File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- eyoucmsEyouCMS arcpagelist Ajax.php unserialize deserialization5.3 Medium
- mmaitre314 picklescanpicklescan - Remote Code Execution via _operator.attrgetter Detection Bypass7.6 High
- mmaitre314 picklescanpicklescan - Undetected Remote Code Execution via _operator.methodcaller7.6 High
- mmaitre314 picklescanPicklescan - Arbitrary Code Execution via numpy.f2py.crackfortran._eval_length Gadget7.6 High
- Show moreLoading…