CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- crm perks wp zendesk for contact form 7, wpforms, elementor, formidable and ninja formsWordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability9.8 Critical
- crm perks integration for keap/infusionsoft and contact form 7, wpforms, elementor, formidable, ninja formsWordPress Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.2.1 - PHP Object Injection vulnerability9.8 Critical
- crm perks wp insightly for contact form 7, wpforms, elementor, formidable and ninja formsWordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability9.8 Critical
- eventprimeWordPress EventPrime plugin <= 4.3.2.1 - PHP Object Injection vulnerability8.1 High
- stiofan events calendar for geodirectoryWordPress Events Calendar for GeoDirectory plugin <= 2.3.25 - PHP Object Injection vulnerability8.8 High
- wombat plugins advanced product fields (product addons) for woocommerceWordPress Advanced Product Fields (Product Addons) for WooCommerce plugin <= 1.6.19 - PHP Object Injection vulnerability7.2 High
- yaycommerce yaymailWordPress YayMail plugin <= 4.3.3 - PHP Object Injection vulnerability7.2 High
- wp chill modula image galleryWordPress Modula Image Gallery plugin <= 2.14.18 - PHP Object Injection vulnerability7.2 High
- eli scheetz anti-malware security and brute-force firewallWordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.87 - PHP Object Injection vulnerability8.8 High
- metaphor creations post duplicatorWordPress Post Duplicator plugin <= 3.0.10 - PHP Object Injection vulnerability8.8 High
- wp overnight woocommerce pdf invoices & packing slipsWordPress WooCommerce PDF Invoices & Packing Slips plugin < 5.9.0 - PHP Object Injection vulnerability7.2 High
- shortpixel image optimizerWordPress ShortPixel Image Optimizer plugin <= 6.4.3 - PHP Object Injection vulnerability7.2 High
- webappick ctx feedWordPress CTX Feed plugin <= 6.6.26 - PHP Object Injection vulnerability7.2 High
- videowhisper paid videochat turnkey siteWordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Deserialization of untrusted data vulnerability8.1 High
- videowhisper broadcast live videoWordPress Broadcast Live Video plugin < 7.1.3 - PHP Object Injection vulnerability9.8 Critical
- crm perks integration for activecampaign and contact form 7, wpforms, elementor, ninja formsWordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.1 - PHP Object Injection vulnerability9.8 Critical
- opensolution quick.cmsInsecure Deserialisation via Plaintext HTTP leading to Remote Code Execution in Quick.CMS7.5 High
org.snmp4j:snmp4j-agentMavenSNMP4J-Agent allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component9.8 Critical- comma ai openpilotComma AI Openpilot Pickle modeld.py pickle.loads deserialization8.5 High
- apache cxf, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, fuse 7 +3 more +5 moreApache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl8.1 High
- apache cxf, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, fuse 7 +8 more +10 moreApache CXF: JNDI Injection Vulnerability in JMSConfigFactory8.1 High
- osgeo geoserver, geoserver org.geoserver.extension:gs-db2 +1 moreGeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection7.2 High
- spring for graphql, vmware spring for graphql +1 moreUnsafe Deserialization in Spring GraphQL8.1 High
- splunk, splunk cloud platform, enterprise +1 more +3 moreRemote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway8.8 High
- jenkins, red hat openshift developer tools and services 4.12, openshift developer tools and services 4.13 +9 more +11 moreJenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation8.8 High
- nationalsecurityagency ghidraGhidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project Connection8.6 High
- concrete cms cmsConcrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search components8.4 High
- broadcom layer 7 api gatewayInsecure Deserialization via MITM in Layer 7 Policy Manager5.3 Medium
- spring for apache pulsar, vmware spring for apache pulsar +1 moreIn Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization8.1 High
- spring for apache kafka, vmware spring for apache kafka, red hat fuse 7 +2 more +4 moreIn Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization8.1 High
- spring security, vmware spring security +1 moreUnfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry7.3 High
- veeam backup and replicationA vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated...9.4 Critical
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Spoofing Vulnerability5.4 Medium
- microsoft sharepoint enterprise server 2016, sharepoint server 2019, sharepoint server subscription edition +1 more +3 moreMicrosoft SharePoint Elevation of Privilege Vulnerability8.8 High
- microsoft nuance powerscribe 360 4.0, nuance powerscribe 360 version 4.0.1, nuance powerscribe 360 version 4.0.2 +21 more +23 moreNuance PowerScribe Remote Code Execution Vulnerability9.8 Critical
- typo3 cmsTYPO3 CMS - Insecure Deserialization in Core API6.3 Medium
- creativethemeshq blocksyBlocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API Field8.8 High
- spring framework, vmware spring framework +1 moreSpring Framework Unsafe Deserialization via Jackson JMS Converters8.1 High
- phpoffice phpspreadsheetPhpSpreadsheet: File::prohibitWrappers bypass9.2 Critical
- thimpress learnpress – backup & migration toolLearnPress – Backup & Migration Tool <= 4.1.4 - Authenticated (Administrator+) PHP Object Injection via WXR XML File Upload6.6 Medium
- codepress admin columnsAdmin Columns <= 7.0.18 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta Value8.8 High
- openstack ironic, red hat openshift container platform 4, openstack platform 16.2 +2 more +4 moreOpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash5.3 Medium
- seagull software, llc. bartender 2021Seagull Software BarTender Deserialization Privilege Escalation via .NET Remoting Service8.5 High
- seagull software, llc. bartender 2010, bartender 2016, bartender 2019 +2 moreSeagull Software BarTender Unauthenticated RCE via .NET Remoting Service9.3 Critical
- apache foryApache Fory: Java ReplaceResolverSerializer deserialization checks bypass9.1 Critical
- concrete cms cmsConcrete CMS below 9.5.3 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction.8.4 High
- apache minaApache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-2329.8 Critical
- aio-libs aiohttp, red hat exploit intelligence, lightspeed core +27 more +29 moreAIOHTTP Vulnerable to Deserialization of Untrusted Data6.4 Medium
- @tanstack react-routerReact Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE8.1 High
- nvidia nvtabularNVIDIA NVTabular contains a vulnerability where an attacker could cause improper deserialization...7.8 High
- Show moreLoading…