CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- liquid web / stellarwp givewpWordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability10.0 Critical
- nippon institute of agroinformatics ltd. soy cmsSOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be...9.3 Critical
- unknown user frontendWP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder7.2 High
- adobe dimensionDimension SQL Injection in Scheduled Report8.6 High
- adobe dimensionDimension SQL Injection in Audit Report8.6 High
- speechbrainSpeechBrain < 1.1.1 Arbitrary Code Execution via CKPT.yaml Parsing8.7 High
- spring cloud stream, vmware spring cloud stream +1 morePotential for deserialization of untrusted types in Spring Cloud Stream3.1 Low
- spring integration, vmware spring integration +1 moreDeserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference8.0 High
- spring for graphql, vmware spring for graphql +1 moreSpring for GraphQL Unsafe Deserialization in pagination support8.1 High
- hashthemes hash formWordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability9.8 Critical
- infinitum form geo controllerWordPress Geo Controller plugin <= 8.9.8 - PHP Object Injection vulnerability9.8 Critical
- wp manage ninja fluent boards proWordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability7.2 High
- magepeopleteam booking and rental managerWordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability8.8 High
- spring amqp, vmware spring advanced message queuing protocol +1 moreRemote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)6.6 Medium
- broadcom spring batch, spring batch +1 moreUnsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist5.6 Medium
- broadcom spring batch, spring batch +1 moreJobParameterDeserializer bypasses the trusted-type allowlist5.6 Medium
- spring integration, vmware spring integration +1 moreUnsafe Java deserialization in SerializingHttpMessageConverter — remote code execution6.4 Medium
- spring integration, vmware spring integration +1 moreJsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list6.3 Medium
- ilias-elearning e.v. iliasILIAS PHP Object Injection via Shibboleth Logout9.3 Critical
- No product listedAn issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src...9.3 Critical
- nltkNLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization9.3 Critical
- typo3 extension "apache solr for typo3 - enterprise search"Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)7.7 High
- typo3 extension "html5 video player vs. powermail"Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)9.3 Critical
- nltkNLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization9.4 Critical
- No product listedAn issue in Beijing Tongtech Co., Ltd tongweb v.7.0.24 in the Spring HttpInovkerServiceExporter...9.8 Critical
- nexcess the events calendarWordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability9.8 Critical
- wedevs wp project managerWordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability9.8 Critical
- a cpt acpt (pro) - custom post types plugin for wordpress, acpt (pro) - custom post types plugin for wordpress +1 moreWordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability9.8 Critical
- combodo itopCombodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences8.7 High
- flairFlair 0.15.0 and 0.15.1 Deserialization of Untrusted Data via ClusteringModel.load8.4 High
- theme-rex freightcoWordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability9.8 Critical
- ggml-org llama.cppggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp deserialize_tensor deserialization6.9 Medium
- buildwps ppwp – password protect pagesPPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles8.8 High
- westguard ws form lite – drag & drop contact form builderWS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission9.8 Critical
- nltkNLTK 3.10.0 through 3.10.2 Remote Code Execution via AllowlistUnpickler Dotted-Name Bypass8.7 High
- ptc flexplm, windchill pdmlink +1 moreServer Side Request Forgery (SSRF) vulnerability reported in Windchill7.7 High
- ptc flexplm, windchill pdmlink +1 moreCritical Remote Code Execution (RCE) vulnerability reported in Windchill9.2 Critical
- microsoft entra id, entra +1 moreMicrosoft Entra ID Remote Code Execution Vulnerability10.0 Critical
- hugging face pytorch image modelsHugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- aeonAeon load_rehab_pile_dataset Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- roxnor fundengineWordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability9.8 Critical
- monkeysan flatasticWordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability9.8 Critical
- wpmu dev forminatorWordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability9.8 Critical
- internlm lmdeployLMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector9.3 Critical
- splunk mcp server app, model context protocol server +1 moreRemote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server app9.1 Critical
- splunk ai toolkitRemote Code Execution (RCE) through Deserialization of Untrusted Data in the Model Loading REST API in Splunk AI Toolkit8.8 High
- wazuhWazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability8.4 High
- dell command update, command update (dcu) +1 moreDell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data...7.8 High
- dell command update, command update (dcu) +1 moreDell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data...7.8 High
- the4 kalles addonsWordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability9.8 Critical
- Show moreLoading…