CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- themerex group let's playWordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability9.8 Critical
- themerex group partisoWordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes rosalindaWordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability9.8 Critical
- themerex group smart casaWordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes smashWordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability9.8 Critical
- themerex group tantraWordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability9.8 Critical
- themerex group travesiaWordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes vetoWordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerability9.8 Critical
- yith woocommerce affiliatesWordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerability7.2 High
- ladela online scheduling and appointment booking system – booklyOnline Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter7.2 High
- chrisbadgett lifterlms – wp lms for elearning, online courses, & quizzes, lifterlms – wp lms for elearning, online courses, & quizzes +1 moreLifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data8.8 High
- google guavaDenial of Service via Eager Array Allocation During Deserialization in Guava8.2 High
- buddhathemes colorfolioWordPress ColorFolio theme <= 1.3 - PHP Object Injection vulnerability8.8 High
- buddhathemes neo | barber shop wordpress themeWordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerability8.8 High
- grid protection alliance openhistorian, openpdc, openpdc (docker image) +2 moreGrid Protection Alliance openPDC and openHistorian Deserialization of Untrusted Data9.3 Critical
- mklacroix product configurator for woocommerceWordPress Product Configurator for WooCommerce plugin <= 1.7.5 - PHP Object Injection vulnerability7.2 High
- expresstech quiz and survey masterWordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability8.8 High
- wp hosting as pay with vipps for woocommerceWordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerability7.2 High
- microsoft dataverseMicrosoft Dataverse Remote Code Execution Vulnerability9.8 Critical
- ibm security verify access, verify identity access, security verify access container +1 more +3 moreSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access9.8 Critical
- ibm security verify access, verify identity access, security verify access container +1 more +3 moreSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access9.8 Critical
- mainwp childWordPress MainWP Child plugin <= 6.2.1 - Deserialization of untrusted data vulnerability8.8 High
- sgl-project sglangCVE-2026-930349.8 Critical
- uncannyowl uncanny automator – ai + automation for wordpress | ai agent, ai page builder, free ai usage includedUncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion7.5 High
- liquid web / stellarwp the events calendarWordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability9.8 Critical
- unitecms unlimited elements for elementor (free widgets, addons, templates), unlimited elements for elementor (free widgets, addons, templates) +1 moreWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - PHP Object Injection vulnerability8.8 High
- @backstage plugin-techdocs-node, backstage, linuxfoundation backstage plugin-techdocs-node +2 moreBackstage: Improper validation of TechDocs MkDocs configuration8.8 High
- lmcacheLMCache Unauthenticated RCE in multiprocess mode via pickle deserialization9.8 Critical
- veeam backup and replicationThis vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code...9.4 Critical
- manacle technologies multi-tenant erp systemUnsafe Deserialization Vulnerability in Manacle Technologies ERP System9.3 Critical
- instawp string locatorString Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor8.8 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities7.5 High
- nvidia model-optimizerNVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of...7.8 High
- hewlett packard enterprise (hpe) clearpass policy manager (cppm)Unauthenticated Deserialization of Untrusted Data allows Remote Code Execution in the Web Interface of HPE Networking ClearPass Policy Manager9.8 Critical
- truelayer magento 2 pluginInsecure deserialization in the TrueLayer Magento 2 plugin7.5 High
- edge-themes haakenWordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability8.1 High
- data443 risk mitigation, inc. gdpr framework by data443WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability9.8 Critical
- viewsonic vcastCVE-2026-829887.5 High
- presstigers simple event plannerWordPress Simple Event Planner plugin <= 1.5.7 - PHP Object Injection vulnerability8.8 High
- vektor inc. vk google job posting managerWordPress VK Google Job Posting Manager plugin <= 1.3.1 - PHP Object Injection vulnerability8.8 High
- wp spell check spell checkWordPress WP Spell Check plugin <= 12.1 - PHP Object Injection vulnerability7.2 High
- sunshinephotocart sunshine photo cartWordPress Sunshine Photo Cart plugin <= 3.7.1 - PHP Object Injection vulnerability7.2 High
- smackcoders wp ultimate exporterWordPress WP Ultimate Exporter plugin <= 3.0 - PHP Object Injection vulnerability7.2 High
- josh kohlbach product feed pro for woocommerceWordPress Product Feed PRO for WooCommerce plugin <= 13.5.7 - PHP Object Injection vulnerability7.2 High
- liquid web / stellarwp advanced post managerWordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability9.8 Critical
- neorazorx facturascriptsFacturaScripts < 2026.7 PHP Object Injection via WidgetSelect6.1 Medium
libyaml-perlDebian,perl-YAMLAlmaLinux +1 moreYAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution7.3 Highlibyaml-perlDebian,perl-YAMLAlmaLinux +1 moreYAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes9.1 Critical- No product listedAn issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary...9.8 Critical
- apache software foundation directory ldap apiApache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements9.8 Critical
- Show moreLoading…