CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- hankcs hanlphankcs HanLP Model Config Loading reflection.py hanlp.load deserialization5.3 Medium
- hankcs hanlphankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserialization5.3 Medium
- chatbot for wordpress - wpbot conversational forms for chatbotWordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability9.8 Critical
- wp chill strong testimonialsWordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability8.8 High
- datastax pulsar-jmsdatastax pulsar-jms PulsarObjectMessage.java decode deserialization5.3 Medium
- unknown acf frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object Injection6.6 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter9.8 Critical
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import7.2 High
- 10up distributor10up Distributor before 2.3.2 PHP Object Injection via set_meta()2.3 Low
- apache software foundation kylinApache Kylin: Redis unsafe Java deserialization9.8 Critical
- gravity forms forms, rocketgenius, inc gravity forms +1 moreWordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability8.1 High
- sunshinephotocart sunshine photo cart – client photo gallery & photo proofing for photographersSunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter9.8 Critical
- johnny5 search regexSearch Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption8.0 High
- lenovo legion zone applicationA potential vulnerability was reported in the Lenovo Legion Zone application, distributed...8.6 High
- modeltc lightllmLightLLM through 1.2.0 Unauthenticated DoS via pd_kv_trans_params Deserialization8.7 High
- dolibarrDolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()7.5 High
- containerd runwasirunwasi: Forged Wasmtime precompiled OCI layer bypasses runwasi WASI sandbox9.3 Critical
- aws amazon neptune engineDeserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune9.4 Critical
- jetbrains teamcityIn JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist...8.1 High
- espocrmEspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params9.1 Critical
- link whisper inc whisper free, unknown link whisper free +1 moreWordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability9.8 Critical
- eclipse vert.xIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],...9.2 Critical
- ilias-elearning e.v. iliasILIAS before 9.24, 10.12, and 11.5 PHP Object Injection via Test Results Import8.7 High
- e107inc e107e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain9.8 Critical
- itthinx affiliatesWordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability9.8 Critical
- brainstorm force surecartWordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability8.8 High
- chouby polylangWordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability7.2 High
- hewlett packard enterprise hpe nonstop middlewareHPE NonStop Middleware - Secret key handling vulnerability7.9 High
- wpazleen post export import with mediaPost Export Import with Media <= 1.17.1 - Authenticated (Administrator+) PHP Object Injection via 'page_data[meta]' Parameter7.2 High
- microsoft sql server 2019 (gdr), sql server 2019 for x64-based systems (cu32), sql server 2022 (gdr) +6 more +8 moreMicrosoft SQL Server Remote Code Execution Vulnerability8.8 High
- xorbitsai xoscarXorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool9.3 Critical
- ibm websphere application server - liberty, websphere application server +1 moreIBM WebSphere Application Server Liberty is affected by a deserialization of untrusted data8.2 High
- ibm websphere application server, websphere application server - liberty +1 moreIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a deserialization of untrusted data7.5 High
- microsoft sharepoint server subscription edition, sharepoint server +1 moreMicrosoft Office SharePoint Remote Code Execution Vulnerability7.4 High
- microsoft dynamics nav 2017, dynamics nav 2018 +1 moreMicrosoft Dynamics 365 Business Central Remote Code Execution Vulnerability8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreMicrosoft Windows Media Foundation Elevation of Privilege Vulnerability7.8 High
- microsoft .net 10.0 runtime, .net 11.0 runtime, .net 8.0 runtime +11 more +13 more.NET Remote Code Execution Vulnerability8.8 High
- microsoft .net 10.0 runtime, .net 11.0 runtime, .net 8.0 runtime +11 more +13 more.NET Framework Remote Code Execution Vulnerability8.8 High
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +2 more +4 moreMicrosoft Exchange Server Elevation of Privilege Vulnerability7.8 High
- microsoft sharepoint server subscription edition, sharepoint server +1 moreMicrosoft Office SharePoint Remote Code Execution Vulnerability8.8 High
- microsoft .net 10.0 runtime, .net 11.0 runtime, .net 8.0 runtime +3 more +5 more.NET Remote Code Execution Vulnerability8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows Management Instrumentation Elevation of Privilege Vulnerability7.8 High
- nvidia megatron-lmNVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an...7.8 High
- nvidia megatron-lmNVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause...7.8 High
- No product listedTensorLayer HDF5 Loading utils.py load_hdf5_graph deserialization5.3 Medium
- yoshitomo-matsubara torchdistillyoshitomo-matsubara torchdistill main_util.py load_ckpt deserialization4.8 Medium
- project-monai monaiMONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nnUNetV2Runner postprocessing_file Path7.0 High
- project-monai monaiMONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP7.7 High
- unclecode crawl4aiCrawl4AI 0.9.0 before 0.9.4 Untrusted Config Gate Bypass Leaks Environment Variables8.6 High
- square squashSquare Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API9.2 Critical
- Show moreLoading…