CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- schneider electric ecostruxure™ power monitoring expert (pme), ecostruxure™ power operation (epo) advanced reporting and dashboards module, schneider-electric ecostruxure power monitoring expert +1 more +3 moreCWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code...8.5 High
- sap se netweaver enterprise portal administrationInsecure Deserialization in SAP NetWeaver Enterprise Portal Administration9.1 Critical
- limesurveyA deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to...9.8 Critical
- miguel useche js archive listJS Archive List <= 6.1.7 - Authenticated (Contributor+) PHP Object Injection via 'included' Shortcode Attribute7.5 High
- langchain langgraphLangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading6.8 Medium
- avira internet security, gen digital inc. avira internet security +1 moreAvira Internet Security System Speedup Insecure Deserialization7.8 High
- crmperks database for contact form 7, wpforms, elementor formsDatabase for Contact Form 7, WPforms, Elementor forms <= 1.4.7 - Unauthenticated PHP Object Injection via 'download_csv'9.8 Critical
- themerex good energyWordPress Good Energy theme <= 1.7.7 - PHP Object Injection vulnerability9.8 Critical
- themerex pizza houseWordPress Pizza House theme <= 1.4.0 - PHP Object Injection vulnerability9.8 Critical
- themerex dentarioWordPress Dentario theme <= 1.5 - PHP Object Injection vulnerability9.8 Critical
- themerex kinglerWordPress Kingler theme <= 1.7 - PHP Object Injection vulnerability9.8 Critical
- themerex tennis clubWordPress Tennis Club theme <= 1.2.3 - PHP Object Injection vulnerability9.8 Critical
- seventhqueen sweet dateWordPress Sweet Date theme < 4.0.1 - PHP Object Injection vulnerability9.8 Critical
- nextscriptsWordPress NextScripts plugin <= 4.4.7 - PHP Object Injection vulnerability8.8 High
- boldthemes celesteWordPress Celeste theme <= 1.3.6 - PHP Object Injection vulnerability8.1 High
- aivahthemes car zoneWordPress Car Zone theme <= 3.7 - Deserialization of untrusted data vulnerability8.8 High
- axiomthemes au pair agency - babysitting & nanny themeWordPress Au Pair Agency - Babysitting & Nanny Theme theme <= 1.2.2 - Deserialization of untrusted data vulnerability8.1 High
- gerritvanaaken podlove web playerWordPress Podlove Web Player plugin <= 5.9.1 - PHP Object Injection vulnerability7.5 High
- blubrry powerpress podcastingWordPress PowerPress Podcasting plugin <= 11.15.10 - PHP Object Injection vulnerability8.8 High
- axiomthemes mounthoodWordPress Mounthood theme <= 1.3.2 - PHP Object Injection vulnerability9.8 Critical
- ancorathemes jardiWordPress Jardi theme <= 1.7.2 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes estateWordPress Estate theme <= 1.3.4 - PHP Object Injection vulnerability9.8 Critical
- themerex equestrian centreWordPress Equestrian Centre theme <= 1.5 - PHP Object Injection vulnerability9.8 Critical
- designthemes dental clinicWordPress Dental Clinic theme <= 3.7 - PHP Object Injection vulnerability8.8 High
- maximsecudeal secudeal payments for ecommerceWordPress Secudeal Payments for Ecommerce plugin <= 1.1 - PHP Object Injection vulnerability8.8 High
- themerex solarisWordPress Solaris theme <= 2.5 - PHP Object Injection vulnerability9.8 Critical
- themerex pets clubWordPress Pets Club theme <= 2.3 - PHP Object Injection vulnerability9.8 Critical
- ancorathemes handymanWordPress Handyman theme <= 1.4.7 - PHP Object Injection vulnerability9.8 Critical
- themegoods grand weddingWordPress Grand Wedding theme < 3.1.11 - PHP Object Injection vulnerability9.8 Critical
- themerex classterWordPress Classter theme <= 2.5 - PHP Object Injection vulnerability9.8 Critical
- cisco secure firewall management center (fmc), secure firewall management center +1 moreCisco Secure Firewall Management Center Software Remote Code Execution Vulnerability10.0 Critical
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below 9.4.8 is vulnerable to stored deserialization leading to RCE in the Express Entry List block.8.9 High
- No product listedAn issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , ...9.8 Critical
- qwikQwik affected by unauthenticated RCE via server$ Deserialization9.2 Critical
- chamilo chamilo-lms, lms +1 moreChamilo: PHAR deserialization bypass7.0 High
- chamilo chamilo-lms, lms +1 moreChamilo: Deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parameters8.8 High
- chamilo chamilo-lms, lms +1 moreChamilo: Post-Auth Remote Code Execution8.7 High
- e-excellence u-office forcee-Excellence｜U-Office Force - Insecure Deserialization9.3 Critical
- smub wp mail loggingWP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field7.5 High
- unknown super stage wpSuper Stage WP <= 1.0.1 - Unauthenticated PHP Object Injection6.5 Medium
- svelte sveltekit, sveltejs kit +1 moreSvelteKit 2.49.0 before 2.53.3 Denial of Service via form8.7 High
- erlang rebar3, hex, hex core +1 more +3 moreUnsafe Deserialization of Erlang Terms in hex_core2.0 Low
- intra-mart accel platform, ntt data intramart corporation intra-mart accel platform +1 moreIM-LogicDesigner module of intra-mart Accel Platform contains insecure deserialization issue....8.6 High
- flairDeserialization of untrusted data in the LanguageModel class of Flair from versions 0.4.1 to...8.4 High
- stylemix ulistingWordPress uListing plugin <= 2.2.0 - PHP Object Injection vulnerability7.2 High
- swaldman c3p0, red hat build of apache camel - hawtio 4, build of apache camel 4.14.4 for spring boot 3.5.11 +15 more +17 morec3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property8.9 High
- langchain-ai langgraph-checkpointLangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution6.6 Medium
- swaldman mchange-commons-java, mchange commons java, red hat build of apache camel - hawtio 4 +17 more +19 moremchange-commons-java: Remote Code Execution via JNDI Reference Resolution8.9 High
- beyond altec doclinkDocLink .NET Remoting Unauthenticated Arbitrary File Read/Write RCE10.0 Critical
- fiserv originate loans peripherals (formerly velocity services) -- print service componentThe Print Service component of Fiserv Originate Loans Peripherals (formerly Velocity Services) in...7.7 High
- Show moreLoading…