CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedAn insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stored values from the d…8.0 High
- ndemic creations plague inc evolvedNdemic Creations Plague Inc Evolved Workshop Scenario Loader deserialization5.3 Medium
- steelraven7 ravenfieldSteelRaven7 Ravenfield RFL Custom Map Handler/RFLD Custom Map cacheCoverPoints deserialization5.3 Medium
- christoph vielgrader relevanssiWordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerability7.2 High
- david de boer paytiumWordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability9.8 Critical
- tribulant software newslettersWordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability9.8 Critical
- codexonics prime mover – backup and migrationPrime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace9.8 Critical
- huggingface datasetsHugging Face Datasets < 5.2.0 Pickle Deserialization RCE via Pandas Builder8.7 High
- baserproject basercmsbaserCMS: PHP object injection via unguarded unserialize() in the widget-area entity7.2 High
- aivahthemes hostme v2WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes holistic centerWordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability9.8 Critical
- themerex zensoulWordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes hallelujahWordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes helionWordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerability8.1 High
- themerex group hotlockWordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability9.8 Critical
- themerex save lifeWordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes little birdiesWordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes rhodosWordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes reprizoWordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability9.8 Critical
- themerex group vagabondsWordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes redyWordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability9.8 Critical
- cgm clininetRemote Code Execution via Java Deserialization in CGM CLININET9.4 Critical
- xnau webdesign participants databaseWordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability9.8 Critical
- pylint-dev pylintPylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME5.4 Medium
- mtw cleanshot xInsecure Deserialization of .cleanshot Files in CleanShot X8.4 High
- bulwarkmail webmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in...7.4 High
- media manager tastyigniterTastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization8.6 High
- pfrest pfsense-pkg-restapipfSense REST API package Vulnerable to Privilege Escalation via Scoped HA Settings Sync Permission8.8 High
- phpoffice phppresentationPHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load9.2 Critical
- gs plugins pins for pinterestWordPress GS Pins for Pinterest plugin <= 1.9.2 - PHP Object Injection vulnerability8.8 High
- gs plugins wordpress team members – gs pluginsWordPress WordPress Team Members – GS Plugins plugin <= 2.8.2 - PHP Object Injection vulnerability8.8 High
- duplicator pro, unknown duplicator pro, smub duplicator – backups & migration plugin – cloud backups, scheduled backups, & more +2 moreDuplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection8.8 High
- mandiant flare flossDeserialization of untrusted data in floss8.7 High
- mandiant flare capaDeserialization of untrusted data in capa8.7 High
- oracle outside in technologyVulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component:...7.8 High
- oracle outside in technologyVulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component:...7.8 High
- oracle outside in technologyVulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component:...7.8 High
- oracle corporation java seVulnerability in Oracle Java SE (component: Security). Supported versions that are affected are...3.7 Low
- apache software foundation couchdbApache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values1.3 Low
- dokuwikiDokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition7.7 High
- uniong webitrUniong｜WebITR - Insecure Deserialization8.7 High
- ibm mq operator, mq advanced container images, supplied mq advanced container images +2 moreIBM MQ Deserialization of Untrusted Data7.5 High
- ibm mq advanced container images, mq operator, supplied mq advanced container images +2 moreIBM MQ Deserialization of Untrusted Data6.5 Medium
- ibm mq advanced container images, mq operator, supplied mq advanced container images +2 moreIBM MQ Deserialization of Untrusted Data6.5 Medium
- mindee doctrdocTR through 1.1.0 Unsafe Deserialization RCE via load_pretrained_params()7.7 High
- apache camelApache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution8.8 High
- apache software foundation camelApache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads8.8 High
- apache camelApache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)10.0 Critical
- expresstech quiz and survey masterWordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability8.8 High
- espnetESPnet Inference Model inference_model.py build_model deserialization5.3 Medium
- Show moreLoading…