CWE-502 · Deserialization of Untrusted Data (page 12)
Page 12 of 31 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-53990 | High | 7.2 | 2025-07-16 | Deserialization of Untrusted Data vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Object Injection.This issue affects JetFormBuilder: from n/… |
CVE-2025-49841 | Critical | 9.8 | 2025-07-15 | GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in process_… |
CVE-2025-49840 | Critical | 9.8 | 2025-07-15 | GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in inferenc… |
CVE-2025-49839 | Critical | 9.8 | 2025-07-15 | GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in bsroform… |
CVE-2025-49838 | Critical | 9.8 | 2025-07-15 | GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in vr.py Au… |
CVE-2025-49837 | Critical | 9.8 | 2025-07-15 | GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in vr.py Au… |
CVE-2025-30761 | Medium | 5.9 | 2025-07-15 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected… |
CVE-2025-7504 | High | 7.5 | 2025-07-12 | The Friends plugin for WordPress is vulnerable to PHP Object Injection in version 3.5.1 via deserialization of untrusted input of the query_vars parameter This… |
CVE-2025-30025 | High | 7.8 | 2025-07-11 | The communication protocol used between the server process and the service control had a flaw that could lead to a local privilege escalation. |
CVE-2025-30023 | Critical | 9.0 | 2025-07-11 | The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execution attack. |
CVE-2025-6742 | High | 7.5 | 2025-07-09 | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.3… |
CVE-2025-7216 | High | 7.3 | 2025-07-09 | A vulnerability, which was classified as critical, was found in lty628 Aidigu up to 1.8.2. This affects the function checkUserCookie of the file /application/c… |
CVE-2025-49533 | Critical | 9.8 | 2025-07-08 | Adobe Experience Manager (MS) versions 6.5.23.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code… |
CVE-2025-27203 | Critical | 9.6 | 2025-07-08 | Adobe Connect versions 24.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an att… |
CVE-2025-47994 | High | 7.8 | 2025-07-08 | Deserialization of untrusted data in Microsoft Office allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-42980 | Critical | 9.1 | 2025-07-08 | SAP NetWeaver Enterprise Portal Federated Portal Network is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialize… |
CVE-2025-42966 | Critical | 9.1 | 2025-07-08 | SAP NetWeaver XML Data Archiving Service allows an authenticated attacker with administrative privileges to exploit an insecure Java deserialization vulnerabil… |
CVE-2025-42964 | Critical | 9.1 | 2025-07-08 | SAP NetWeaver Enterprise Portal Administration is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could p… |
CVE-2025-42963 | Critical | 9.1 | 2025-07-08 | A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator users to exploit unsafe Java object deseri… |
CVE-2025-6811 | Critical | 9.8 | 2025-07-07 | Mescius ActiveReports.NET TypeResolutionService Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attacke… |
CVE-2025-6810 | Critical | 9.8 | 2025-07-07 | Mescius ActiveReports.NET ReadValue Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut… |
CVE-2025-7099 | Medium | 5.6 | 2025-07-07 | A vulnerability has been found in BoyunCMS up to 1.21 on PHP7 and classified as critical. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2025-52828 | High | 8.8 | 2025-07-04 | Deserialization of Untrusted Data vulnerability in designthemes Red Art redart allows Object Injection.This issue affects Red Art: from n/a through <= 3.8. |
CVE-2025-49417 | Critical | 9.8 | 2025-07-04 | Deserialization of Untrusted Data vulnerability in BestWpDeveloper WooCommerce Product Multi-Action Woo-product-multiaction allows Object Injection.This issue… |
CVE-2025-43713 | Medium | 6.5 | 2025-07-03 | ASNA Assist and ASNA Registrar before 2025-03-31 allow deserialization attacks against .NET remoting. These are Windows system services that support license ke… |
CVE-2025-34067 | | 2025-07-02 | An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Platform due to the u… | |
CVE-2024-13786 | Critical | 9.8 | 2025-07-02 | The education theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.10 via deserialization of untrusted input in… |
CVE-2025-6464 | High | 7.5 | 2025-07-02 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and i… |
CVE-2025-34060 | | 2025-07-01 | A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image… | |
CVE-2025-53416 | High | 7.8 | 2025-06-30 | Delta Electronics DTN Soft Project File Parsing Deserialization of Untrusted Data Remote Code Execution |
CVE-2025-53415 | High | 7.8 | 2025-06-30 | Delta Electronics DTM Soft Project File Parsing Deserialization of Untrusted Data Remote Code Execution |
CVE-2025-53393 | Medium | 6.0 | 2025-06-28 | In Akka through 2.10.6, akka-cluster-metrics uses Java serialization for cluster metrics. |
CVE-2025-32897 | Critical | 9.8 | 2025-06-28 | Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This security vulnerability is the same as CVE-2024-47552, but the version range… |
CVE-2025-52827 | High | 8.8 | 2025-06-27 | Deserialization of Untrusted Data vulnerability in uxper Nuss nuss allows Object Injection.This issue affects Nuss: from n/a through <= 1.3.3. |
CVE-2025-52826 | High | 8.8 | 2025-06-27 | Deserialization of Untrusted Data vulnerability in uxper Sala allows Object Injection. This issue affects Sala: from n/a through 1.1.3. |
CVE-2025-52725 | Critical | 9.8 | 2025-06-27 | Deserialization of Untrusted Data vulnerability in pebas CouponXxL couponxxl allows Object Injection.This issue affects CouponXxL: from n/a through <= 3.0.0. |
CVE-2025-52724 | Critical | 9.8 | 2025-06-27 | Deserialization of Untrusted Data vulnerability in BoldThemes Amwerk amwerk allows Object Injection.This issue affects Amwerk: from n/a through <= 1.2.0. |
CVE-2025-28970 | Critical | 9.8 | 2025-06-27 | Deserialization of Untrusted Data vulnerability in pep.vn WP Optimize By xTraffic wp-optimize-by-xtraffic allows Object Injection.This issue affects WP Optimiz… |
CVE-2025-53002 | High | 8.3 | 2025-06-26 | LLaMA-Factory is a tuning library for large language models. A remote code execution vulnerability was discovered in LLaMA-Factory versions up to and including… |
CVE-2025-36038 | Critical | 9.0 | 2025-06-25 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of seriali… |
CVE-2025-2566 | | 2025-06-24 | Kaleris NAVIS N4 ULC (Ultra Light Client) contains an unsafe Java deserialization vulnerability. An unauthenticated attacker can make specially crafted request… | |
CVE-2025-25034 | | 2025-06-20 | A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP seria… | |
CVE-2025-47771 | | 2025-06-20 | PowSyBl (Power System Blocks) is a framework to build power system oriented software. In versions 6.3.0 to 6.7.1, there is a deserialization issue in the read… | |
CVE-2025-6279 | Medium | 5.5 | 2025-06-19 | A vulnerability, which was classified as critical, has been found in Upsonic up to 0.55.6. This issue affects the function cloudpickle.loads of the file /tools… |
CVE-2025-49217 | Critical | 9.8 | 2025-06-17 | An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected… |
CVE-2025-49214 | High | 8.8 | 2025-06-17 | An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code execution on affected… |
CVE-2025-49213 | Critical | 9.8 | 2025-06-17 | An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected… |
CVE-2025-49212 | Critical | 9.8 | 2025-06-17 | An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected… |
CVE-2025-49220 | Critical | 9.8 | 2025-06-17 | An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected i… |
CVE-2025-49219 | Critical | 9.8 | 2025-06-17 | An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on affected… |
CVE-2025-49331 | High | 7.2 | 2025-06-17 | Deserialization of Untrusted Data vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Object Injection.This issue affects eCo… |
CVE-2025-49330 | Critical | 9.8 | 2025-06-17 | Deserialization of Untrusted Data vulnerability in CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin cf7-zoho allows Object Injection.This issue aff… |
CVE-2025-31919 | Critical | 9.8 | 2025-06-17 | Deserialization of Untrusted Data vulnerability in themeton Spare allows Object Injection. This issue affects Spare: from n/a through 1.7. |
CVE-2025-30618 | Critical | 9.8 | 2025-06-17 | Deserialization of Untrusted Data vulnerability in yuliaz Rapyd Payment Extension for WooCommerce rapyd-payments allows Object Injection.This issue affects Rap… |
CVE-2025-24919 | High | 8.1 | 2025-06-13 | A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell ControlVault3 prior to 5.15.10.14 and ControlVault3 Pl… |
CVE-2025-47166 | High | 8.8 | 2025-06-10 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2025-47163 | High | 8.8 | 2025-06-10 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2025-49507 | Critical | 9.8 | 2025-06-10 | Deserialization of Untrusted Data vulnerability in LoftOcean CozyStay cozystay allows Object Injection.This issue affects CozyStay: from n/a through < 1.7.1. |
CVE-2025-27819 | High | 7.5 | 2025-06-10 | In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect A… |
CVE-2025-27818 | High | 8.8 | 2025-06-10 | A possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig to the cluster resource, or Kafka Connect worker… |
CVE-2025-31429 | Critical | 9.8 | 2025-06-09 | Deserialization of Untrusted Data vulnerability in themeton PressGrid - Frontend Publish Reaction & Multimedia Theme allows Object Injection. This issue affect… |
CVE-2025-31398 | Critical | 9.8 | 2025-06-09 | Deserialization of Untrusted Data vulnerability in themeton PIMP - Creative MultiPurpose allows Object Injection. This issue affects PIMP - Creative MultiPurpo… |
CVE-2025-31396 | Critical | 9.8 | 2025-06-09 | Deserialization of Untrusted Data vulnerability in themeton FLAP - Business WordPress Theme allows Object Injection. This issue affects FLAP - Business WordPre… |
CVE-2025-31052 | Critical | 9.8 | 2025-06-09 | Deserialization of Untrusted Data vulnerability in themeton The Fashion - Model Agency One Page Beauty Theme nrgfashion allows Object Injection.This issue affe… |
CVE-2025-49127 | | 2025-06-06 | Kafbat UI is a web user interface for managing Apache Kafka clusters. An unsafe deserialization vulnerability in version 1.0.0 allows any unauthenticated user… | |
CVE-2025-27531 | Critical | 9.8 | 2025-06-06 | Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 before 2.1.0, this issue would allow an aut… |
CVE-2025-49073 | Critical | 9.8 | 2025-06-06 | Deserialization of Untrusted Data vulnerability in axiomthemes Sweet Dessert sweet-dessert allows Object Injection.This issue affects Sweet Dessert: from n/a t… |
CVE-2025-49072 | Critical | 9.8 | 2025-06-06 | Deserialization of Untrusted Data vulnerability in AncoraThemes Mr. Murphy mr-murphy allows Object Injection.This issue affects Mr. Murphy: from n/a through <… |
CVE-2025-47584 | High | 8.5 | 2025-06-06 | Deserialization of Untrusted Data vulnerability in ThemeGoods Photography.This issue affects Photography: from n/a through 7.5.2. |
CVE-2025-39358 | High | 8.8 | 2025-06-06 | Deserialization of Untrusted Data vulnerability in teastudio.pl WP Posts Carousel wp-posts-carousel allows Object Injection.This issue affects WP Posts Carouse… |
CVE-2025-48780 | Critical | 9.8 | 2025-06-06 | A deserialization of untrusted data vulnerability in the download file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.040… |
CVE-2025-5680 | Medium | 6.3 | 2025-06-05 | A vulnerability classified as critical was found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 2.5.0. Affected by this vulnerability is the… |
CVE-2025-5679 | Medium | 6.3 | 2025-06-05 | A vulnerability classified as critical has been found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 2.5.0. Affected is the function parseStr… |
CVE-2025-20276 | Low | 3.8 | 2025-06-04 | A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, remote attacker to execute arbitrary code on an affect… |
CVE-2025-20275 | Medium | 5.3 | 2025-06-04 | A vulnerability in the file opening process of Cisco Unified Contact Center Express (Unified CCX) Editor could allow an unauthenticated attacker to execute arb… |
CVE-2025-5552 | Medium | 6.3 | 2025-06-04 | A vulnerability was found in ChestnutCMS up to 15.1. It has been declared as critical. This vulnerability affects unknown code of the file /dev-api/groovy/exec… |
CVE-2025-48951 | | 2025-06-03 | Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. Versions 8.0.0-BETA3 prior to 8.3.1 contain a vulnerability due to insecure deserializatio… | |
CVE-2025-5499 | High | 7.3 | 2025-06-03 | A vulnerability classified as critical has been found in slackero phpwcms up to 1.9.45/1.10.8. Affected is the function is_file/getimagesize of the file image_… |
CVE-2025-5498 | Medium | 5.5 | 2025-06-03 | A vulnerability was found in slackero phpwcms up to 1.9.45/1.10.8. It has been rated as critical. This issue affects the function file_get_contents/is_file of… |
CVE-2025-5497 | Medium | 6.3 | 2025-06-03 | A vulnerability was detected in slackero phpwcms up to 1.9.45/1.10.8. The impacted element is an unknown function of the file include/inc_module/mod_feedimport… |
CVE-2025-2939 | Medium | 5.6 | 2025-06-03 | The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.0.18 via deserial… |
CVE-2025-5086 | Critical | 9.0 | 2025-06-02 | A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution. |
CVE-2025-49113 | Critical | 9.9 | 2025-06-02 | Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validat… |
CVE-2025-5326 | Medium | 6.3 | 2025-05-29 | A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as critical. Affected by this issue is some… |
CVE-2025-48336 | Critical | 9.8 | 2025-05-29 | Deserialization of Untrusted Data vulnerability in ThimPress Course Builder course-builder allows Object Injection.This issue affects Course Builder: from n/a… |
CVE-2025-48389 | High | 7.2 | 2025-05-29 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to deserialization of untrusted data due to ins… |
CVE-2025-27528 | Critical | 9.1 | 2025-05-28 | Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability allows att… |
CVE-2025-27526 | Medium | 6.5 | 2025-05-28 | Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability which can le… |
CVE-2025-27522 | Medium | 6.5 | 2025-05-28 | Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability is a seconda… |
CVE-2025-5174 | Medium | 5.3 | 2025-05-26 | A vulnerability was found in erdogant pypickle up to 1.1.5 and classified as problematic. Affected by this issue is the function load of the file pypickle/pypi… |
CVE-2025-5173 | Medium | 5.3 | 2025-05-26 | A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as problematic. Affected by… |
CVE-2025-5148 | Medium | 5.3 | 2025-05-25 | A vulnerability was found in FunAudioLLM InspireMusic up to bf32364bcb0d136497ca69f9db622e9216b029dd. It has been classified as critical. Affected is the funct… |
CVE-2025-5114 | Medium | 6.3 | 2025-05-23 | A vulnerability has been found in easysoft zentaopms 21.5_20250307 and classified as critical. This vulnerability affects the function Edit of the file /index… |
CVE-2025-48289 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in AncoraThemes Kids Planet kidsplanet allows Object Injection.This issue affects Kids Planet: from n/a through… |
CVE-2025-48287 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in Pagaleve Pix 4x sem juros - Pagaleve wc-pagaleve allows Object Injection.This issue affects Pix 4x sem juros… |
CVE-2025-47660 | High | 8.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in Codexpert, Inc WC Affiliate wc-affiliate allows Object Injection.This issue affects WC Affiliate: from n/a t… |
CVE-2025-47568 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in ZoomIt ZoomSounds dzs-zoomsounds allows Object Injection.This issue affects ZoomSounds: from n/a through <=… |
CVE-2025-47532 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in CoinPayments CoinPayments.net Payment Gateway for WooCommerce coinpayments-payment-gateway-for-woocommerce a… |
CVE-2025-47530 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in WPFunnels WPFunnels wpfunnels allows Object Injection.This issue affects WPFunnels: from n/a through <= 3.5… |
CVE-2025-39503 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Object Injection.This issue affects Goodlayers Hotel: from n/a… |