CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- dotstore extra fees plugin for woocommerceWordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerability8.8 High
- gesundheit bewegt gmbh zippyWordPress Zippy plugin <= 1.7.0 - PHP Object Injection vulnerability7.2 High
- arni cinco wpcargo track & traceWordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerability7.2 High
- zoho flow flowWordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability9.8 Critical
- themerex gunslingerWordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability9.8 Critical
- themerex good homesWordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability9.8 Critical
- themerex gamicWordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability9.8 Critical
- themerex gamezoneWordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability9.8 Critical
- themerex emojinationWordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability9.8 Critical
- themerex edge decorWordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability9.8 Critical
- themerex coinpressWordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability9.8 Critical
- themerex bonbonWordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability9.8 Critical
- themerex avventureWordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability9.8 Critical
- themerex filmaxWordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability9.8 Critical
- themerex orpheusWordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability9.8 Critical
- themerex nutsWordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability9.8 Critical
- themerex muziconWordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability9.8 Critical
- themerex motorixWordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability9.8 Critical
- themerex missionWordPress Mission theme <= 1.22 - PHP Object Injection vulnerability9.8 Critical
- themerex meals & wheelsWordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability9.8 Critical
- themerex marcellWordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability9.8 Critical
- themerex le truffeWordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability9.8 Critical
- themerex legal stoneWordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability9.8 Critical
- eyal fitoussi geo my wordpressWordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability9.8 Critical
- themerex ozistiWordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability9.8 Critical
- themerex preservationWordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability9.8 Critical
- themerex printyWordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability9.8 Critical
- themerex quirkyWordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability9.8 Critical
- themerex rexcoinWordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability9.8 Critical
- yaycommerce yaymailWordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability7.2 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities8.1 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities8.8 High
- m a vinoth kumar frontend dashboard, metagauss profilegrid +1 moreFrontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection9.0 Critical
- drupal single content syncSingle Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-2757.2 High
- ultralyticsUltralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- ultralyticsUltralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- jenkinsJenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction...8.8 High
- jenkinsJenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections...5.4 Medium
- jenkinsJenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to...8.8 High
- stepasyuk filter everything — wordpress & woocommerce filtersWordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.7 - PHP Object Injection vulnerability7.2 High
- ultimate member memberWordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability9.8 Critical
- crossi72 phoenix media renameWordPress Phoenix Media Rename plugin <= 3.13.5 - PHP Object Injection vulnerability8.8 High
- dokan, inc. dokanWordPress Dokan plugin <= 5.3.1 - PHP Object Injection vulnerability7.2 High
- pickplugins accordionWordPress Accordion plugin <= 2.3.25 - PHP Object Injection vulnerability7.2 High
- gs plugins logo slider, unknown gs logo slider +1 moreWordPress GS Logo Slider plugin <= 3.8.9 - PHP Object Injection vulnerability8.8 High
- rankmath rank math seo – ai seo tools to dominate seo rankingsRank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution8.8 High
- fasterxml jackson-databindjackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)9.8 Critical
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint8.8 High
- lxsmnsyc serovalSeroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check7.3 High
- vllmvLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled7.5 High
- Show moreLoading…