CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- wpdesk flexible subscriptionsWordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability9.8 Critical
- splware esprocSPLWare esProc SocketData.java ObjectInputStream.readUnshared deserialization6.9 Medium
- oracle outside in technologyVulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component:...7.8 High
- oracle outside in technologyVulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component:...7.8 High
- project-monai monaiMONAI before 1.6.0 Remote Code Execution via NumpyReader8.5 High
- project-monai monaiMONAI before 1.6.0 Remote Code Execution via algo_from_pickle8.5 High
- steve burge taxopressWordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability8.8 High
- youzifyWordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability9.8 Critical
- supsystic popup by supsysticWordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerability9.8 Critical
- supsystic ultimate maps by supsysticWordPress Ultimate Maps by Supsystic plugin < 1.5.0 - PHP Object Injection vulnerability9.8 Critical
- supsystic easy google mapsWordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability9.8 Critical
- metagauss registrationmagicWordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability9.8 Critical
- derek herman optiontreeWordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability7.2 High
- roxnor fundengineWordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability9.8 Critical
- g5theme essential real estateWordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability8.8 High
- progress sharefile storage zones controllerRemote code execution via unsafe deserialization in Progress ShareFile Storage Zones Controller's CICO service8.0 High
- reputeinfosystems contact form, survey, quiz & popup form builder – arformsContact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection9.8 Critical
- wpweaver turnkey bbpress by weaverthemeTurnkey bbPress by WeaverTheme <= 1.7.1 - Authenticated (Administrator+) PHP Object Injection6.6 Medium
- eric teubert podlove podcast publisherPodlove Podcast Publisher <= 4.5.3 - Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl_data' Parameter8.8 High
- aveva enterprise scada, enterprise scada hmi, pipeline integrity monitor (delivered on pipeline simulation media) +3 more +5 moreAVEVA Enterprise SCADA Deserialization of Untrusted Data6.1 Medium
- alldatacenter alldataalldatacenter alldata xxl-rpc Listener HessianSerializer.java Hessian2Input.readObject deserialization6.9 Medium
- ibm websphere application server - liberty, websphere application server +1 moreIBM WebSphere Application Server Liberty is affected by a denial of service5.7 Medium
- apache shindig, apache software foundation shindig common, shindig social-api +2 moreApache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)7.2 High
- booking activities team activitiesWordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability8.8 High
- miniorange headless single sign onWordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability9.8 Critical
- magepeopleteam car rental managerWordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability7.2 High
- ash-project ash, ash-hq ash framework +1 moreFilter expression injection via forged keyset pagination cursor in Ash7.5 High
- apache airflowApache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server8.8 High
- fujitsu research onecompressionFujitsu OneCompression < 1.2.1 Arbitrary Code Execution via torch.load Deserialization8.4 High
- apache airflowApache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint5.4 Medium
- apache airflowApache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization7.3 High
- apache airflowApache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget8.8 High
- jfrog artifactoryPotential insecure deserialization in JFrog Artifactory6.6 Medium
- red hat amq broker 7, build of apache camel 4 for quarkus 3, build of apache camel for spring boot 4 +6 more +8 moreArtemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in red hat eap permit deserialization by default8.8 High
- sonicwall gmsAn insecure handling of serialized objects vulnerability was found in the one of the service of...8.4 High
- adobe lightroom, lightroom classic +1 moreLightroom Classic | Deserialization of Untrusted Data (CWE-502)8.6 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.8 High
- microsoft sharepoint server subscription edition, sharepoint server +1 moreMicrosoft SharePoint Remote Code Execution Vulnerability8.8 High
- microsoft dynamics 365, dynamics 365 (on-premises) version 9.1 +1 moreMicrosoft Dynamics 365 On-Premises Remote Code Execution Vulnerability8.8 High
- microsoft sharepoint server, sharepoint server 2019, sharepoint server subscription edition +2 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.8 High
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 moreMicrosoft Exchange Server Denial of Service Vulnerability6.5 Medium
- microsoft hpc pack 2019, windows app +1 moreMicrosoft High Performance Computing (HPC) Pack Remote Code Execution Vulnerability9.8 Critical
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Spoofing Vulnerability6.5 Medium
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.8 High
- intel extension for pytorchDeserialization of untrusted data for some Intel(R) Extension for PyTorch before version 2.8.0...4.6 Medium
- dassault systèmes simulia execution engineDeserialization of Untrusted Data Vulnerability in SIMULIA Execution Engine from Release 2023 through Release 202610.0 Critical
- Show moreLoading…