CWE-502 · Deserialization of Untrusted Data (page 15)

Page 15 of 31 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.

All CVEs classified under CWE-502 — newest first (page 15 of 31)
CVESeverityScorePublishedSummary
CVE-2025-1113Medium6.32025-02-07A vulnerability was found in taisan tarzan-cms up to 1.0.0. It has been rated as critical. This issue affects the function upload of the file /admin#themes of…
CVE-2021-27017Medium6.62025-02-07Utilization of a module presented a security risk by allowing the deserialization of untrusted/user supplied data. This is resolved in the Puppet Agent 7.4.0 r…
CVE-2024-9664High7.22025-02-07The WP All Import Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.9.7 via deserialization of untrusted i…
CVE-2025-10772025-02-07A security vulnerability has been identified in the IBL Software Engineering Visual Weather and derived products (NAMIS, Aero Weather, Satellite Weather). The…
CVE-2025-0994High8.82025-02-06Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This…
CVE-2025-20124Critical9.92025-02-05A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected device. T…
CVE-2025-24661High8.82025-02-03Deserialization of Untrusted Data vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Object Injection.This i…
CVE-2025-0974Medium5.02025-02-03A vulnerability was determined in MaxD Lightning Module 4.43/4.44 on OpenCart. This issue affects some unknown processing. Executing a manipulation of the argu…
CVE-2024-13742Critical9.82025-01-30The iControlWP – Multiple WordPress Site Manager plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.4.5 via des…
CVE-2025-24794Medium6.72025-01-29The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations…
CVE-2025-0841High7.32025-01-29A vulnerability has been found in Aridius XYZ up to 20240927 on OpenCart and classified as critical. This vulnerability affects the function loadMore of the co…
CVE-2025-23045Critical9.82025-01-28Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with an account on an affected CVAT i…
CVE-2024-0140Medium6.82025-01-28NVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a deserialization of untrusted data issue. A successful exploit of this vulne…
CVE-2025-0734Medium4.72025-01-27A vulnerability has been found in y_project RuoYi up to 4.8.0 and classified as critical. This vulnerability affects the function getBeanName of the component…
CVE-2025-24357High7.52025-01-27vLLM is a library for LLM inference and serving. vllm/model_executor/weight_utils.py implements hf_model_weights_iterator to load the model checkpoint, which i…
CVE-2025-24671Critical9.82025-01-27Deserialization of Untrusted Data vulnerability in Pdfcrowd Dev Team Save as PDF save-as-pdf-by-pdfcrowd allows Object Injection.This issue affects Save as PDF…
CVE-2025-24601Critical9.82025-01-27Deserialization of Untrusted Data vulnerability in ThimPress FundPress fundpress allows Object Injection.This issue affects FundPress: from n/a through <= 2.0…
CVE-2024-12600High7.22025-01-25The Custom Product Tabs Lite for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.0 via deseria…
CVE-2025-23006Critical9.82025-01-23Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management…
CVE-2025-23914Critical9.82025-01-22Deserialization of Untrusted Data vulnerability in muzaara Muzaara Google Ads Report muzaara-adwords-optimize-dashboard allows Object Injection.This issue affe…
CVE-2024-31903High8.82025-01-22IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 allow an attacker on the local network to execute arbitrary co…
CVE-2025-23944High8.82025-01-22Deserialization of Untrusted Data vulnerability in bulktheme WOOEXIM wooexim allows Object Injection.This issue affects WOOEXIM: from n/a through <= 5.0.0.
CVE-2025-23932Critical9.82025-01-22Deserialization of Untrusted Data vulnerability in Marko-M Quick Count quick-count allows Object Injection.This issue affects Quick Count: from n/a through <=…
CVE-2025-0429High7.22025-01-22The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of unt…
CVE-2025-0428High7.22025-01-22The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of unt…
CVE-2024-49699High8.82025-01-21Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4…
CVE-2024-49688Critical9.82025-01-21Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4…
CVE-2024-10936High8.82025-01-21The String locator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.6 via deserialization of untrusted inpu…
CVE-2025-0586High7.22025-01-20The a+HRD from aEnrich Technology has an Insecure Deserialization vulnerability, allowing remote attackers with database modification privileges and regular sy…
CVE-2024-12703High7.82025-01-17CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on wo…
CVE-2024-56515Medium6.82025-01-16Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. If SVG or JPEGXL thumbnailers are enabled (they are disabled by…
CVE-2024-57766Critical9.12025-01-15MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/editField.
CVE-2024-57764Critical9.12025-01-15MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/add.
CVE-2024-57763Critical9.12025-01-15MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/addField.
CVE-2024-57762High7.52025-01-15MSFM before v2025.01.01 was discovered to contain a deserialization vulnerability via the pom.xml configuration file.
CVE-2024-49375Critical9.02025-01-14Open source machine learning framework. A vulnerability has been identified in Rasa that enables an attacker who has the ability to load a maliciously crafted…
CVE-2025-21364High7.82025-01-14Microsoft Excel Security Feature Bypass Vulnerability
CVE-2025-0465High7.32025-01-14A vulnerability was found in AquilaCMS 1.412.13. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/v2/catego…
CVE-2024-13163High7.82025-01-14Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthen…
CVE-2025-22777Critical9.82025-01-13Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give allows Object Injection.This issue affects GiveWP: from n/a through <= 3.19.3.
CVE-2024-12877Critical9.82025-01-11The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 v…
CVE-2024-12627High7.52025-01-11The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to PHP Object Injection in all ve…
CVE-2024-13297Medium6.62025-01-09Deserialization of Untrusted Data vulnerability in Drupal Eloqua allows Object Injection.This issue affects Eloqua: from 7.X-* before 7.X-1.15.
CVE-2024-13296Medium6.62025-01-09Deserialization of Untrusted Data vulnerability in Drupal Mailjet allows Object Injection.This issue affects Mailjet: from 0.0.0 before 4.0.1.
CVE-2024-13295Medium6.62025-01-09Deserialization of Untrusted Data vulnerability in Drupal Node export allows Object Injection.This issue affects Node export: from 7.X-* before 7.X-3.3.
CVE-2024-13288Medium4.32025-01-09Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.This issue affects Monster Menus: from 0.0.0 before 9.3.4, from…
CVE-2025-22510High7.22025-01-09Deserialization of Untrusted Data vulnerability in kkarpieszuk WC Price History for Omnibus wc-price-history allows Object Injection.This issue affects WC Pric…
CVE-2023-27531Medium5.32025-01-09There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization code
CVE-2024-54676Critical9.82025-01-08Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https…
CVE-2022-45185High8.82025-01-07An issue was discovered in SuiteCRM 7.12.7. Authenticated users can use CRM functions to upload malicious files. Then, deserialization can be used to achieve c…
CVE-2024-55555High8.82025-01-07Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APP_KEY. This is exacerbated by .env files…
CVE-2024-55556Critical9.82025-01-07A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on the server by manipul…
CVE-2024-56291High8.12025-01-07Deserialization of Untrusted Data vulnerability in plainware PlainInventory z-inventory-manager allows Object Injection.This issue affects PlainInventory: from…
CVE-2024-56283High8.12025-01-07Deserialization of Untrusted Data vulnerability in plainware Locatoraid Store Locator locatoraid allows Object Injection.This issue affects Locatoraid Store Lo…
CVE-2024-49222Critical9.82025-01-07Deserialization of Untrusted Data vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Object Injection.This issue affects WPGuppy: from n/a…
CVE-2024-12313High8.12025-01-07The Compare Products for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.1 via deserialization…
CVE-2024-11465High7.22025-01-07The Custom Product Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserializat…
CVE-2024-20150High7.52025-01-06In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service with no additional execution privileges needed. Us…
CVE-2024-13136Medium6.32025-01-05A vulnerability was found in wangl1989 mysiteforme 1.0 and classified as critical. Affected by this issue is the function rememberMeManager of the file src/mai…
CVE-2024-10957High8.82025-01-04The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions from 1.23.8 to 1.24.11 via deserializa…
CVE-2024-10932High8.82025-01-04The Backup Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.6 via deserialization of untrusted in…
CVE-2024-56068High7.52024-12-31Deserialization of Untrusted Data vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
CVE-2024-12994Medium6.32024-12-28A vulnerability was found in running-elephant Datart 1.0.0-rc3. It has been rated as critical. Affected by this issue is the function extractModel of the file…
CVE-2024-52046Critical9.82024-12-25The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security…
CVE-2024-12721High7.22024-12-21The Custom Product Tabs For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.4 via deserializat…
CVE-2024-12677High7.82024-12-20Delta Electronics DTM Soft deserializes objects, which could allow an attacker to execute arbitrary code.
CVE-2024-12741High7.82024-12-18A deserialization of untrusted data vulnerability exists in NI DAQExpress that may result in remote code execution. Successful exploitation requires an attacke…
CVE-2024-56058Critical9.82024-12-18Deserialization of Untrusted Data vulnerability in denniskravetstns VRPConnector vrpconnector allows Object Injection.This issue affects VRPConnector: from n/a…
CVE-2024-12687Critical9.82024-12-16Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes. This issue affects Ple…
CVE-2024-10095High8.42024-12-16In Progress Telerik UI for WPF versions prior to 2024 Q4 (2024.4.1213), a code execution attack is possible through an insecure deserialization vulnerability.
CVE-2024-54367Critical9.82024-12-16Deserialization of Untrusted Data vulnerability in Ultimate Member ForumWP forumwp allows Object Injection.This issue affects ForumWP: from n/a through <= 2.1…
CVE-2024-54282High7.22024-12-13Deserialization of Untrusted Data vulnerability in Themeum WP Mega Menu wp-megamenu allows Object Injection.This issue affects WP Mega Menu: from n/a through <…
CVE-2024-54273Critical9.82024-12-13Deserialization of Untrusted Data vulnerability in PickPlugins Mail Picker mail-picker allows Object Injection.This issue affects Mail Picker: from n/a through…
CVE-2024-11839High7.52024-12-13Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes.This issue affects PlexT…
CVE-2024-49147Critical9.32024-12-12Deserialization of untrusted data in Microsoft Update Catalog allows an unauthorized attacker to elevate privileges on the website’s webserver.
CVE-2024-12312High8.12024-12-12The Print Science Designer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.152 via deserialization of untr…
CVE-2024-49070High7.42024-12-12Microsoft SharePoint Remote Code Execution Vulnerability
CVE-2024-49063High8.42024-12-12Microsoft/Muzic Remote Code Execution Vulnerability
CVE-2024-11949High8.82024-12-12GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra…
CVE-2024-11947High8.82024-12-12GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar…
CVE-2024-53247High8.82024-12-10In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7, and versions below 3.4.261 and 3.7.13 of the Splunk Secure Gateway app on Splunk Cloud Platform, a…
CVE-2024-49849High7.82024-12-10A vulnerability has been identified in SIMATIC S7-PLCSIM V16 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 Safety V16 (All versions), SI…
CVE-2024-55638Critical9.82024-12-10Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before…
CVE-2024-55637Critical9.82024-12-10Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 b…
CVE-2024-55636Critical9.82024-12-10Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 b…
CVE-2024-11501High8.82024-12-07The Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3 via deserialization of untrusted input from wd…
CVE-2024-54136Critical9.82024-12-06ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 5.5.1 Revision 199 and below is vulnerable to PHP Deserialization vulnerabilit…
CVE-2024-54135Critical9.82024-12-06ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 2.0 to Version 5.5.1 Revision 199 are vulnerable to PHP Deserialization vulner…
CVE-2022-41137High8.32024-12-05Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and c…
CVE-2024-12138Medium6.32024-12-04A vulnerability classified as critical was found in horilla up to 1.2.1. This vulnerability affects the function request_new/get_employee_shift/create_reimburs…
CVE-2024-10587High8.82024-12-04The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to PHP Object Injection…
CVE-2024-51363Critical9.82024-12-03Insecure deserialization in Hodoku v2.3.0 to v2.3.2 allows attackers to execute arbitrary code.
CVE-2024-53477Critical9.82024-12-02JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java
CVE-2024-52338Critical9.82024-11-28Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An ap…
CVE-2024-53673High8.12024-11-26A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code.
CVE-2024-11145Critical9.82024-11-26Valor Apps Easy Folder Listing Pro has a deserialization vulnerability that allows an unauthenticated, remote attacker to execute arbitrary code with the privi…
CVE-2024-11662Medium6.32024-11-25A vulnerability was found in welliamcao OpsManage 3.0.1/3.0.2/3.0.3/3.0.4/3.0.5. It has been rated as critical. This issue affects the function deploy_host_var…
CVE-2024-53915Critical9.82024-11-24An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24405. It allows remote attackers to execute arbitrary code because untr…
CVE-2024-53914Critical9.82024-11-24An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24344. It allows remote attackers to execute arbitrary code because untr…
CVE-2024-53913Critical9.82024-11-24An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24343. It allows remote attackers to execute arbitrary code because untr…