CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- dhis2 dhis2-coreDHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)9.1 Critical
- theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 moreForeman: ssti and insecure deserialization in foreman-rake configuration7.7 High
- icegramWordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerability8.8 High
- dotstore hide shipping method for woocommerceWordPress Hide Shipping Method For WooCommerce plugin <= 1.5.4 - PHP Object Injection vulnerability7.2 High
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway deserialization of untrusted data7.2 High
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway Deserialization of Untrusted Data6.6 Medium
- accellion kiteworks, kiteworks core +1 moreKiteworks Core deserialization of untrusted data8.1 High
- themehigh extra product options for woocommerce | custom product addons and fieldsWordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability7.2 High
- 10web photo gallery by 10webWordPress Photo Gallery by 10Web plugin <= 1.8.46 - PHP Object Injection vulnerability8.8 High
- hook & filter nested pagesWordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability9.8 Critical
- magazine3 schema & structured data for wp & ampWordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerability8.8 High
- gpriday page builder by siteoriginWordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerability7.2 High
- the wikimedia foundation mediawiki wikibase extensionUnauthenticated arbitrary file deletion through Wikibase serialized entity parsing7.2 High
- modeltc lightllmLightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service9.3 Critical
- vercel next.jsNext.js: Denial of Service in App Router using Server Actions8.2 High
- booking activities team activitiesWordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability9.8 Critical
- shortpixel image optimizerWordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerability4.9 Medium
- themefic ultimate addons for contact form 7WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability7.2 High
- keywordrush content eggWordPress Content Egg plugin <= 6.3.1 - PHP Object Injection vulnerability7.2 High
- themifyme themify builderWordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability8.8 High
- implecode ecommerce product catalogWordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability7.2 High
- wedevs wp erpWordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability7.2 High
- chatbot for wordpress - wpbot conversational forms for chatbotWordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerability8.8 High
- justin nealey designsetgoWordPress DesignSetGo plugin <= 2.8.0 - PHP Object Injection vulnerability8.8 High
- mat lipe go live update urlsWordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerability8.8 High
- nexcess kadence woocommerce email designerWordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability7.2 High
- a wp life responsive slider galleryWordPress Responsive Slider Gallery plugin <= 1.5.5 - PHP Object Injection vulnerability7.2 High
- 10web booster – website speed optimization, cache & page speed optimizerWordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.33.6 - PHP Object Injection vulnerability8.8 High
- seo squirrly plugin by squirrly seoWordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability8.8 High
- wpfactory cost of goods for woocommerceWordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability7.2 High
- dotstore minimum and maximum quantity for woocommerceWordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Injection vulnerability7.2 High
- codepeople music player for woocommerceWordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability7.2 High
- digiwin easyflow .netDigiWin｜EasyFlow .NET - Insecure Deserialization9.3 Critical
- exactly www ewww image optimizerEWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta6.6 Medium
- watchguard fireware, fireware os +1 moreFireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution7.5 High
- modeltc lightllmLightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service9.3 Critical
- modeltc lightllmLightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service9.3 Critical
- aws gluontsGluonTS arbitrary command execution during model deserialization8.4 High
- octopus deploy serverIn affected versions of Octopus Server, an authenticated user with permissions to edit an...8.7 High
- google cloud application integrationDeserialization of Untrusted Data in Application Integration allows Remote Code Execution9.4 Critical
- apache software foundation rollerApache Roller: Unauthenticated deserialization in the XML-RPC endpoint9.8 Critical
- unknown online scheduling and appointment booking systemBookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced Options4.7 Medium
- project-monai monaiMONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache8.5 High
- langchain4jlangchain4j LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerializer.fromJson deserialization2.1 Low
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.7.2 High
- No product listedOpen-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization6.9 Medium
yara-xcrates.ioyara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB4.8 Medium- mongodb php driverPHP object injection via unsuppressible __pclass class inference in command monitoring events6.3 Medium
- alam00000 bentopdfBentoPDF: Workflow Import Allows Unvalidated TSA URL Leading to PDF Hash Exfiltration via RFC 3161 Requests3.4 Low
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- Show moreLoading…