CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- yonyou u8 cloudYonyou U8 Cloud Java Deserialization RCE via FileManageServlet9.3 Critical
- openbankproject obp-apiOpenBankProject OBP-API Kryo Redis.scala KryoInjection.invert deserialization2.1 Low
- ibm mqIBM MQ Java messaging is vulnerable to remote code execution8.8 High
- webpros whmcsDeserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows...9.3 Critical
- ibm app connect enterpriseIBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs7.8 High
- ibm app connect enterpriseIBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs7.8 High
- octobercms octoberOctober CMS: PHP Object Injection via Backend Widget Session Storage3.3 Low
- modeltc lightllmLightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization9.3 Critical
- fedml-ai fedmlFedML-AI FedML MQTT+S3 Communication Backend remote_storage.py S3Storage.read_model deserialization5.3 Medium
- phpgurukul small crmPHPGurukul Small CRM Login Success login.php unserialize deserialization6.3 Medium
- espnetESPnet before 202609 Remote Code Execution via Unsafe Deserialization8.7 High
- lenve vhrlenve vhr MailReceiver deserialization5.3 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution8.8 High
- stellarwp the events calendarThe Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution9.8 Critical
- unknown wpstorecartIDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php8.1 High
- unknown masteriyo lmsMasteriyo LMS < 3.4.1 - Subscriber+ PHP Object Injection9.9 Critical
- gitlabDeserialization of Untrusted Data in GitLab9.9 Critical
- masteriyo - lms, themegrill masteriyo - lms +1 moreWordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability8.8 High
- themerex addonsWordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability9.8 Critical
- wpeverest everest formsWordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability9.8 Critical
- filerunFileRun < 2026.3.0 PHP Object Injection via Perms::getPerms()8.6 High
- marcin wise chatWordPress Wise Chat plugin <= 3.4.2 - PHP Object Injection vulnerability8.1 High
- unknown site reviewsSite Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature8.1 High
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service6.5 Medium
- maxsite cmsMaxSite CMS through 109.6 PHP Object Injection via ci_session9.2 Critical
- red hat ceph storage 5, ceph storage 9, openstack platform 17.1 +1 more +3 moreCommunity.general: community.general: memcached cache plugin deserializes untrusted pickle data from memcached, enabling cache-poisoning remote code execution on the ansible controller8.1 High
- kstover ninja forms – the contact form builder that grows with youNinja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import6.6 Medium
- tile-ai tilelangtile-ai tilelang Kernel Cache kernel_cache.py KernelCache._load_kernel_from_disk deserialization5.1 Medium
- microsoft publisher, 365 apps, 365 apps for enterprise +6 more +8 moreMicrosoft Office Publisher Remote Code Execution Vulnerability8.8 High
- microsoft sql server 2019 (cu 32), sql server 2019 (gdr), sql server 2022 (cu 26) +6 more +8 moreMicrosoft SQL Server Remote Code Execution Vulnerability8.8 High
- microsoft dynamics 365, dynamics 365 (on-premises) version 9.1 +1 moreMicrosoft Dynamics 365 On-Premises Remote Code Execution Vulnerability8.8 High
- microsoft sql server 2019 (cu 32), sql server 2019 (gdr), sql server 2022 (cu 26) +6 more +8 moreMicrosoft SQL Server Remote Code Execution Vulnerability8.1 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +20 more +22 moreWindows IP Address Management (IPAM) Service Elevation of Privilege Vulnerability7.0 High
- ivanti neurons for itsmA Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows...8.8 High
- ivanti neurons for itsmA Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows...9.9 Critical
- ivanti neurons for itsmA Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows...8.8 High
- ivanti neurons for itsmA Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows...9.8 Critical
- ivanti neurons for itsmA Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows...9.8 Critical
- commvault, commvault cloud +1 moreContent Extractor Privilege Escalation7.3 High
- livecomposer live composer – free wordpress website builderLive Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode8.8 High
- hitachi cosminexus component containerDeserialization of Untrusted Data Vulnerability in Cosminexus Component Container9.8 Critical
- sap se netweaver business clientInsecure Deserialization in SAP NetWeaver Business Client7.8 High
- next4biz information technologies inc. csm (customer service management)Code Injection in Next4Biz's CSM (Customer Service Management)9.8 Critical
- getwpfunnels mail mint – email marketing, newsletter, email automation & woocommerce emailsMail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields9.8 Critical
- nanbu welcart e-commerceWelcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback8.8 High
- solidinvoiceSolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop7.5 High
- ibm qiskit sdkQiskit SDK is vulnerable when deserializing QPY Files and may overflow the available stack space.6.2 Medium
- eyecix jobsearchWordPress JobSearch plugin <= 3.2.0 - PHP Object Injection vulnerability9.8 Critical
- unknown mail mintWordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability9.8 Critical
- rometheme rtmkitWordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability8.8 High
- Show moreLoading…