CWE-502 · Deserialization of Untrusted Data (page 17)
Page 17 of 34 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-31087 | Critical | 9.8 | 2025-04-01 | Deserialization of Untrusted Data vulnerability in silverplugins217 Multiple Shipping And Billing Address For Woocommerce different-shipping-and-billing-addres… |
CVE-2025-31084 | Critical | 9.8 | 2025-04-01 | Deserialization of Untrusted Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshin… |
CVE-2025-31074 | High | 8.8 | 2025-04-01 | Deserialization of Untrusted Data vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Object Injection.This issue affects Mobile DJ Manager: from… |
CVE-2025-31129 | High | 8.8 | 2025-03-31 | Jooby is a web framework for Java and Kotlin. The pac4j io.jooby.internal.pac4j.SessionStoreImpl#get module deserializes untrusted data. This vulnerability is… |
CVE-2025-31103 | High | 7.5 | 2025-03-31 | Untrusted data deserialization vulnerability exists in a-blog cms. Processing a specially crafted request may store arbitrary files on the server where the pro… |
CVE-2025-22526 | Critical | 9.8 | 2025-03-28 | Deserialization of Untrusted Data vulnerability in mywebtonet PHP/MySQL CPU performance statistics mywebtonet-performancestats allows Object Injection.This iss… |
CVE-2025-2485 | High | 7.5 | 2025-03-28 | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3… |
CVE-2025-26873 | Critical | 9.0 | 2025-03-27 | Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1. |
CVE-2025-2855 | Medium | 4.7 | 2025-03-27 | A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is the function checkFile of the file… |
CVE-2025-30773 | High | 7.2 | 2025-03-27 | Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePr… |
CVE-2025-2332 | Critical | 9.8 | 2025-03-27 | The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.13 v… |
CVE-2025-1913 | High | 7.2 | 2025-03-26 | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, a… |
CVE-2024-13889 | High | 7.2 | 2025-03-26 | The WordPress Importer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.8.3 via deserialization of untrusted… |
CVE-2025-29310 | Critical | 9.8 | 2025-03-24 | An issue in onos v2.7.0 allows attackers to trigger a packet deserialization problem when supplying a crafted LLDP packet. This vulnerability allows attackers… |
CVE-2025-2690 | Medium | 6.3 | 2025-03-24 | A vulnerability, which was classified as critical, was found in yiisoft Yii2 up to 2.0.39. This affects the function Generate of the file phpunit\src\Framework… |
CVE-2025-2689 | Medium | 6.3 | 2025-03-24 | A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45. Affected by this issue is the function getIterator of the file… |
CVE-2025-2622 | Medium | 6.3 | 2025-03-22 | A vulnerability was found in aizuda snail-job 1.4.0. It has been classified as critical. Affected is the function getRuntime of the file /snail-job/workflow/ch… |
CVE-2025-1971 | High | 7.2 | 2025-03-22 | The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserializ… |
CVE-2025-0724 | High | 8.8 | 2025-03-22 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.4… |
CVE-2025-29807 | High | 8.7 | 2025-03-21 | Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network. |
CVE-2025-30160 | High | 7.5 | 2025-03-20 | Redlib is an alternative private front-end to Reddit. A vulnerability has been identified in Redlib where an attacker can cause a denial-of-service (DOS) condi… |
CVE-2025-23120 | High | 8.8 | 2025-03-20 | A vulnerability allowing remote code execution (RCE) for domain users. |
CVE-2024-13921 | High | 7.2 | 2025-03-20 | The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.0 via dese… |
CVE-2024-9701 | Critical | 9.8 | 2025-03-20 | A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execu… |
CVE-2024-9070 | Critical | 9.8 | 2025-03-20 | A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions <=1.3.4.post1. By setting specific parameters, an attacker can ex… |
CVE-2024-9053 | Critical | 9.8 | 2025-03-20 | vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints. The core functionality run_server_loop() calls t… |
CVE-2024-8502 | Critical | 9.8 | 2025-03-20 | A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution (RCE) via deserialization of untrusted d… |
CVE-2024-12433 | Critical | 9.8 | 2025-03-20 | A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey 'authkey=b'infinif… |
CVE-2024-12044 | Critical | 9.8 | 2025-03-20 | A remote code execution vulnerability exists in open-mmlab/mmdetection version v3.3.0. The vulnerability is due to the use of the `pickle.loads()` function in… |
CVE-2024-12029 | Critical | 9.8 | 2025-03-20 | A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises fr… |
CVE-2024-11041 | Critical | 9.8 | 2025-03-20 | vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. The function uses pickle.loads to parse received sockets… |
CVE-2024-11039 | High | 8.8 | 2025-03-20 | A pickle deserialization vulnerability exists in the Latex English error correction plug-in function of binary-husky/gpt_academic versions up to and including… |
CVE-2024-10553 | Critical | 9.8 | 2025-03-20 | A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untruste… |
CVE-2024-10190 | Critical | 9.8 | 2025-03-20 | Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-e… |
CVE-2024-47552 | Critical | 9.8 | 2025-03-20 | Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): from 2.0.0 before 2.2.0. … |
CVE-2025-27781 | Critical | 9.8 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in inference.py. `model_file` in inference.py as we… |
CVE-2025-27780 | Critical | 9.8 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in model_information.py. `model_name` in model_info… |
CVE-2025-27779 | Critical | 9.8 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in `model_blender.py` lines 20 and 21. `model_fusio… |
CVE-2025-27778 | Critical | 9.8 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in `infer.py`. The issue can lead to remote code ex… |
CVE-2025-29783 | Critical | 9.0 | 2025-03-19 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. When vLLM is configured to use Mooncake, unsafe deserialization exposed d… |
CVE-2024-13410 | Critical | 9.8 | 2025-03-19 | The CozyStay and TinySalt plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.7.0, and in all versions up to… |
CVE-2025-2376 | High | 7.3 | 2025-03-17 | A vulnerability has been found in viames Pair Framework up to 1.9.11 and classified as critical. Affected by this vulnerability is the function getCookieConten… |
CVE-2025-26921 | High | 8.8 | 2025-03-15 | Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection… |
CVE-2025-2000 | Critical | 9.8 | 2025-03-14 | A maliciously crafted QPY file can potential execute arbitrary-code embedded in the payload without privilege escalation when deserialising QPY formats < 13. A… |
CVE-2024-13824 | Critical | 9.8 | 2025-03-14 | The CiyaShop - Multipurpose WooCommerce Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.19.0 via deseri… |
CVE-2024-10942 | High | 7.5 | 2025-03-13 | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.89 via deserializatio… |
CVE-2025-27925 | High | 8.5 | 2025-03-10 | Nintex Automation 5.6 and 5.7 before 5.8 has insecure deserialization of user input. |
CVE-2025-24813 | Critical | 9.8 | 2025-03-10 | Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files vi… |
CVE-2025-25940 | Critical | 9.8 | 2025-03-10 | VisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java. |
CVE-2025-27816 | Critical | 9.8 | 2025-03-07 | A vulnerability was discovered in the Arctera InfoScale 7.0 through 8.0.2 where a .NET remoting endpoint can be exploited due to the insecure deserialization o… |
CVE-2024-13906 | High | 7.2 | 2025-03-07 | The Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up… |
CVE-2025-2043 | Medium | 4.7 | 2025-03-06 | A vulnerability was found in LinZhaoguan pb-cms 1.0.0 and classified as critical. This issue affects some unknown processing of the file /admin#themes of the c… |
CVE-2024-12742 | High | 7.8 | 2025-03-06 | A deserialization of untrusted data vulnerability exists in NI G Web Development Software that may result in arbitrary code execution. Successful exploitation… |
CVE-2025-0956 | High | 8.1 | 2025-03-05 | The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 24.4.0 via deserializat… |
CVE-2024-13787 | Critical | 9.8 | 2025-03-05 | The VEDA - MultiPurpose WordPress Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2 via deserialization… |
CVE-2024-13777 | High | 8.1 | 2025-03-05 | The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.9… |
CVE-2025-0912 | Critical | 9.8 | 2025-03-04 | The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted i… |
CVE-2025-26999 | High | 8.8 | 2025-03-03 | Deserialization of Untrusted Data vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Object Injection.This issue a… |
CVE-2025-26967 | High | 8.8 | 2025-03-03 | Deserialization of Untrusted Data vulnerability in Stiofan Events Calendar for GeoDirectory events-for-geodirectory allows Object Injection.This issue affects… |
CVE-2025-26885 | High | 7.2 | 2025-03-03 | Deserialization of Untrusted Data vulnerability in Beaver Builder WordPress Assistant assistant allows Object Injection.This issue affects WordPress Assistant… |
CVE-2024-47092 | Critical | 9.8 | 2025-03-03 | Insecure deserialization and improper certificate validation in Checkmk Exchange plugin check-mk-api prior to 5.8.1 |
CVE-2024-13833 | High | 7.2 | 2025-03-01 | The Album Gallery – WordPress Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.3 via deserializatio… |
CVE-2025-0769 | | 2025-02-28 | PixelYourSite - Your smart PIXEL (TAG) and API Manager 10.1.1.1 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function… | |
CVE-2024-13831 | High | 7.2 | 2025-02-28 | The Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization of untruste… |
CVE-2025-0767 | Critical | 9.8 | 2025-02-27 | WP Activity Log 5.3.2 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/classes/Writers/class-csv-writer… |
CVE-2025-1741 | Medium | 4.7 | 2025-02-27 | A vulnerability classified as problematic was found in b1gMail up to 7.4.1-pl1. Affected by this vulnerability is an unknown functionality of the file src/admi… |
CVE-2025-26900 | Critical | 9.8 | 2025-02-25 | Deserialization of Untrusted Data vulnerability in flexmls Flexmls® IDX flexmls-idx allows Object Injection.This issue affects Flexmls® IDX: from n/a through <… |
CVE-2025-27301 | High | 7.2 | 2025-02-24 | Deserialization of Untrusted Data vulnerability in Nazmul Hasan Robin NHR Options Table Manager nhrrob-options-table-manager allows Object Injection.This issue… |
CVE-2025-27300 | High | 7.2 | 2025-02-24 | Deserialization of Untrusted Data vulnerability in giuliopanda ADFO admin-form allows Object Injection.This issue affects ADFO: from n/a through <= 1.9.1. |
CVE-2025-26763 | Critical | 9.8 | 2025-02-22 | Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider ml-slider allows Object Injection.This issue affects Responsive S… |
CVE-2025-1556 | Medium | 4.7 | 2025-02-22 | A vulnerability, which was classified as problematic, has been found in westboy CicadasCMS 1.0. This issue affects some unknown processing of the file /system… |
CVE-2024-13899 | High | 7.2 | 2025-02-22 | The Mambo Importer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0 via deserialization of untrusted input… |
CVE-2025-1403 | High | 8.6 | 2025-02-21 | Qiskit SDK 0.45.0 through 1.2.4 could allow a remote attacker to cause a denial of service using a maliciously crafted QPY file containing a malformed symengin… |
CVE-2024-13789 | Critical | 9.8 | 2025-02-20 | The ravpage plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.31 via deserialization of untrusted input from t… |
CVE-2024-37361 | Critical | 9.9 | 2025-02-20 | The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. (CWE-502) Hitachi Vantara Pentaho Bus… |
CVE-2024-28777 | High | 8.8 | 2025-02-19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to unrestricted deserialization. This vulnerability allows users to… |
CVE-2024-13556 | High | 8.1 | 2025-02-18 | The Affiliate Links: WordPress Plugin for Link Cloaking and Link Management plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, a… |
CVE-2024-12562 | Critical | 9.8 | 2025-02-15 | The s2Member Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 241216 via deserialization of untrusted input… |
CVE-2024-56180 | Critical | 9.8 | 2025-02-14 | CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft plugin module in Apache EventMesh master branch without release version on windows\linux\m… |
CVE-2024-52577 | Critical | 9.0 | 2025-02-14 | In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could b… |
CVE-2024-13770 | High | 8.1 | 2025-02-13 | The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and includ… |
CVE-2025-1186 | Medium | 6.3 | 2025-02-12 | A vulnerability was found in dayrui XunRuiCMS up to 4.6.4. It has been declared as critical. This vulnerability affects unknown code of the file /Control/Api/A… |
CVE-2025-1177 | Medium | 6.3 | 2025-02-11 | A vulnerability was found in dayrui XunRuiCMS 4.6.3. It has been classified as critical. Affected is the function import_add of the file dayrui/Fcms/Control/Ad… |
CVE-2025-24016 | Critical | 9.9 | 2025-02-10 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe d… |
CVE-2025-1113 | Medium | 6.3 | 2025-02-07 | A vulnerability was found in taisan tarzan-cms up to 1.0.0. It has been rated as critical. This issue affects the function upload of the file /admin#themes of… |
CVE-2021-27017 | Medium | 6.6 | 2025-02-07 | Utilization of a module presented a security risk by allowing the deserialization of untrusted/user supplied data. This is resolved in the Puppet Agent 7.4.0 r… |
CVE-2024-9664 | High | 7.2 | 2025-02-07 | The WP All Import Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.9.7 via deserialization of untrusted i… |
CVE-2025-1077 | | 2025-02-07 | A security vulnerability has been identified in the IBL Software Engineering Visual Weather and derived products (NAMIS, Aero Weather, Satellite Weather). The… | |
CVE-2025-0994 | High | 8.8 | 2025-02-06 | Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This… |
CVE-2025-20124 | Critical | 9.9 | 2025-02-05 | A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected device. T… |
CVE-2025-24661 | High | 8.8 | 2025-02-03 | Deserialization of Untrusted Data vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Object Injection.This i… |
CVE-2025-0974 | Medium | 5.0 | 2025-02-03 | A vulnerability was determined in MaxD Lightning Module 4.43/4.44 on OpenCart. This issue affects some unknown processing. Executing a manipulation of the argu… |
CVE-2024-13742 | Critical | 9.8 | 2025-01-30 | The iControlWP – Multiple WordPress Site Manager plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.4.5 via des… |
CVE-2025-24794 | Medium | 6.7 | 2025-01-29 | The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations… |
CVE-2025-0841 | High | 7.3 | 2025-01-29 | A vulnerability has been found in Aridius XYZ up to 20240927 on OpenCart and classified as critical. This vulnerability affects the function loadMore of the co… |
CVE-2025-23045 | Critical | 9.8 | 2025-01-28 | Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with an account on an affected CVAT i… |
CVE-2024-0140 | Medium | 6.8 | 2025-01-28 | NVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a deserialization of untrusted data issue. A successful exploit of this vulne… |
CVE-2025-0734 | Medium | 4.7 | 2025-01-27 | A vulnerability has been found in y_project RuoYi up to 4.8.0 and classified as critical. This vulnerability affects the function getBeanName of the component… |
CVE-2025-24357 | High | 7.5 | 2025-01-27 | vLLM is a library for LLM inference and serving. vllm/model_executor/weight_utils.py implements hf_model_weights_iterator to load the model checkpoint, which i… |
CVE-2025-24671 | Critical | 9.8 | 2025-01-27 | Deserialization of Untrusted Data vulnerability in Pdfcrowd Dev Team Save as PDF save-as-pdf-by-pdfcrowd allows Object Injection.This issue affects Save as PDF… |