CWE-502 · Deserialization of Untrusted Data (page 18)
Page 18 of 34 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-24601 | Critical | 9.8 | 2025-01-27 | Deserialization of Untrusted Data vulnerability in ThimPress FundPress fundpress allows Object Injection.This issue affects FundPress: from n/a through <= 2.0… |
CVE-2024-12600 | High | 7.2 | 2025-01-25 | The Custom Product Tabs Lite for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.0 via deseria… |
CVE-2025-23006 | Critical | 9.8 | 2025-01-23 | Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management… |
CVE-2025-23914 | Critical | 9.8 | 2025-01-22 | Deserialization of Untrusted Data vulnerability in muzaara Muzaara Google Ads Report muzaara-adwords-optimize-dashboard allows Object Injection.This issue affe… |
CVE-2024-31903 | High | 8.8 | 2025-01-22 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 allow an attacker on the local network to execute arbitrary co… |
CVE-2025-23944 | High | 8.8 | 2025-01-22 | Deserialization of Untrusted Data vulnerability in bulktheme WOOEXIM wooexim allows Object Injection.This issue affects WOOEXIM: from n/a through <= 5.0.0. |
CVE-2025-23932 | Critical | 9.8 | 2025-01-22 | Deserialization of Untrusted Data vulnerability in Marko-M Quick Count quick-count allows Object Injection.This issue affects Quick Count: from n/a through <=… |
CVE-2025-0429 | High | 7.2 | 2025-01-22 | The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of unt… |
CVE-2025-0428 | High | 7.2 | 2025-01-22 | The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of unt… |
CVE-2024-49699 | High | 8.8 | 2025-01-21 | Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4… |
CVE-2024-49688 | Critical | 9.8 | 2025-01-21 | Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4… |
CVE-2024-10936 | High | 8.8 | 2025-01-21 | The String locator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.6 via deserialization of untrusted inpu… |
CVE-2025-0586 | High | 7.2 | 2025-01-20 | The a+HRD from aEnrich Technology has an Insecure Deserialization vulnerability, allowing remote attackers with database modification privileges and regular sy… |
CVE-2024-12703 | High | 7.8 | 2025-01-17 | CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on wo… |
CVE-2024-56515 | Medium | 6.8 | 2025-01-16 | Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. If SVG or JPEGXL thumbnailers are enabled (they are disabled by… |
CVE-2024-57766 | Critical | 9.1 | 2025-01-15 | MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/editField. |
CVE-2024-57764 | Critical | 9.1 | 2025-01-15 | MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/add. |
CVE-2024-57763 | Critical | 9.1 | 2025-01-15 | MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/addField. |
CVE-2024-57762 | High | 7.5 | 2025-01-15 | MSFM before v2025.01.01 was discovered to contain a deserialization vulnerability via the pom.xml configuration file. |
CVE-2024-49375 | Critical | 9.0 | 2025-01-14 | Open source machine learning framework. A vulnerability has been identified in Rasa that enables an attacker who has the ability to load a maliciously crafted… |
CVE-2025-21364 | High | 7.8 | 2025-01-14 | Microsoft Excel Security Feature Bypass Vulnerability |
CVE-2025-0465 | High | 7.3 | 2025-01-14 | A vulnerability was found in AquilaCMS 1.412.13. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/v2/catego… |
CVE-2024-13163 | High | 7.8 | 2025-01-14 | Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthen… |
CVE-2025-22777 | Critical | 9.8 | 2025-01-13 | Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give allows Object Injection.This issue affects GiveWP: from n/a through <= 3.19.3. |
CVE-2024-12877 | Critical | 9.8 | 2025-01-11 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 v… |
CVE-2024-12627 | High | 7.5 | 2025-01-11 | The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to PHP Object Injection in all ve… |
CVE-2024-13297 | Medium | 6.6 | 2025-01-09 | Deserialization of Untrusted Data vulnerability in Drupal Eloqua allows Object Injection.This issue affects Eloqua: from 7.X-* before 7.X-1.15. |
CVE-2024-13296 | Medium | 6.6 | 2025-01-09 | Deserialization of Untrusted Data vulnerability in Drupal Mailjet allows Object Injection.This issue affects Mailjet: from 0.0.0 before 4.0.1. |
CVE-2024-13295 | Medium | 6.6 | 2025-01-09 | Deserialization of Untrusted Data vulnerability in Drupal Node export allows Object Injection.This issue affects Node export: from 7.X-* before 7.X-3.3. |
CVE-2024-13288 | Medium | 4.3 | 2025-01-09 | Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.This issue affects Monster Menus: from 0.0.0 before 9.3.4, from… |
CVE-2025-22510 | High | 7.2 | 2025-01-09 | Deserialization of Untrusted Data vulnerability in kkarpieszuk WC Price History for Omnibus wc-price-history allows Object Injection.This issue affects WC Pric… |
CVE-2023-27531 | Medium | 5.3 | 2025-01-09 | There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization code |
CVE-2024-54676 | Critical | 9.8 | 2025-01-08 | Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https… |
CVE-2022-45185 | High | 8.8 | 2025-01-07 | An issue was discovered in SuiteCRM 7.12.7. Authenticated users can use CRM functions to upload malicious files. Then, deserialization can be used to achieve c… |
CVE-2024-55555 | High | 8.8 | 2025-01-07 | Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APP_KEY. This is exacerbated by .env files… |
CVE-2024-55556 | Critical | 9.8 | 2025-01-07 | A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on the server by manipul… |
CVE-2024-56291 | High | 8.1 | 2025-01-07 | Deserialization of Untrusted Data vulnerability in plainware PlainInventory z-inventory-manager allows Object Injection.This issue affects PlainInventory: from… |
CVE-2024-56283 | High | 8.1 | 2025-01-07 | Deserialization of Untrusted Data vulnerability in plainware Locatoraid Store Locator locatoraid allows Object Injection.This issue affects Locatoraid Store Lo… |
CVE-2024-49222 | Critical | 9.8 | 2025-01-07 | Deserialization of Untrusted Data vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Object Injection.This issue affects WPGuppy: from n/a… |
CVE-2024-12313 | High | 8.1 | 2025-01-07 | The Compare Products for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.1 via deserialization… |
CVE-2024-11465 | High | 7.2 | 2025-01-07 | The Custom Product Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserializat… |
CVE-2024-20150 | High | 7.5 | 2025-01-06 | In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service with no additional execution privileges needed. Us… |
CVE-2024-13136 | Medium | 6.3 | 2025-01-05 | A vulnerability was found in wangl1989 mysiteforme 1.0 and classified as critical. Affected by this issue is the function rememberMeManager of the file src/mai… |
CVE-2024-10957 | High | 8.8 | 2025-01-04 | The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions from 1.23.8 to 1.24.11 via deserializa… |
CVE-2024-10932 | High | 8.8 | 2025-01-04 | The Backup Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.6 via deserialization of untrusted in… |
CVE-2024-56068 | High | 7.5 | 2024-12-31 | Deserialization of Untrusted Data vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup.This issue affects WP SuperBackup: from n/a through <= 2.3.3. |
CVE-2024-12994 | Medium | 6.3 | 2024-12-28 | A vulnerability was found in running-elephant Datart 1.0.0-rc3. It has been rated as critical. Affected by this issue is the function extractModel of the file… |
CVE-2024-52046 | Critical | 9.8 | 2024-12-25 | The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security… |
CVE-2024-12721 | High | 7.2 | 2024-12-21 | The Custom Product Tabs For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.4 via deserializat… |
CVE-2024-12677 | High | 7.8 | 2024-12-20 | Delta Electronics DTM Soft deserializes objects, which could allow an attacker to execute arbitrary code. |
CVE-2024-12741 | High | 7.8 | 2024-12-18 | A deserialization of untrusted data vulnerability exists in NI DAQExpress that may result in remote code execution. Successful exploitation requires an attacke… |
CVE-2024-56058 | Critical | 9.8 | 2024-12-18 | Deserialization of Untrusted Data vulnerability in denniskravetstns VRPConnector vrpconnector allows Object Injection.This issue affects VRPConnector: from n/a… |
CVE-2024-12687 | Critical | 9.8 | 2024-12-16 | Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes. This issue affects Ple… |
CVE-2024-10095 | High | 8.4 | 2024-12-16 | In Progress Telerik UI for WPF versions prior to 2024 Q4 (2024.4.1213), a code execution attack is possible through an insecure deserialization vulnerability. |
CVE-2024-54367 | Critical | 9.8 | 2024-12-16 | Deserialization of Untrusted Data vulnerability in Ultimate Member ForumWP forumwp allows Object Injection.This issue affects ForumWP: from n/a through <= 2.1… |
CVE-2024-54282 | High | 7.2 | 2024-12-13 | Deserialization of Untrusted Data vulnerability in Themeum WP Mega Menu wp-megamenu allows Object Injection.This issue affects WP Mega Menu: from n/a through <… |
CVE-2024-54273 | Critical | 9.8 | 2024-12-13 | Deserialization of Untrusted Data vulnerability in PickPlugins Mail Picker mail-picker allows Object Injection.This issue affects Mail Picker: from n/a through… |
CVE-2024-11839 | High | 7.5 | 2024-12-13 | Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes.This issue affects PlexT… |
CVE-2024-49147 | Critical | 9.3 | 2024-12-12 | Deserialization of untrusted data in Microsoft Update Catalog allows an unauthorized attacker to elevate privileges on the website’s webserver. |
CVE-2024-12312 | High | 8.1 | 2024-12-12 | The Print Science Designer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.152 via deserialization of untr… |
CVE-2024-49070 | High | 7.4 | 2024-12-12 | Microsoft SharePoint Remote Code Execution Vulnerability |
CVE-2024-49063 | High | 8.4 | 2024-12-12 | Microsoft/Muzic Remote Code Execution Vulnerability |
CVE-2024-11949 | High | 8.8 | 2024-12-12 | GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2024-11947 | High | 8.8 | 2024-12-12 | GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2024-53247 | High | 8.8 | 2024-12-10 | In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7, and versions below 3.4.261 and 3.7.13 of the Splunk Secure Gateway app on Splunk Cloud Platform, a… |
CVE-2024-49849 | High | 7.8 | 2024-12-10 | A vulnerability has been identified in SIMATIC S7-PLCSIM V16 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 Safety V16 (All versions), SI… |
CVE-2024-55638 | Critical | 9.8 | 2024-12-10 | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before… |
CVE-2024-55637 | Critical | 9.8 | 2024-12-10 | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 b… |
CVE-2024-55636 | Critical | 9.8 | 2024-12-10 | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 b… |
CVE-2024-11501 | High | 8.8 | 2024-12-07 | The Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3 via deserialization of untrusted input from wd… |
CVE-2024-54136 | Critical | 9.8 | 2024-12-06 | ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 5.5.1 Revision 199 and below is vulnerable to PHP Deserialization vulnerabilit… |
CVE-2024-54135 | Critical | 9.8 | 2024-12-06 | ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 2.0 to Version 5.5.1 Revision 199 are vulnerable to PHP Deserialization vulner… |
CVE-2022-41137 | High | 8.3 | 2024-12-05 | Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and c… |
CVE-2024-12138 | Medium | 6.3 | 2024-12-04 | A vulnerability classified as critical was found in horilla up to 1.2.1. This vulnerability affects the function request_new/get_employee_shift/create_reimburs… |
CVE-2024-10587 | High | 8.8 | 2024-12-04 | The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to PHP Object Injection… |
CVE-2024-51363 | Critical | 9.8 | 2024-12-03 | Insecure deserialization in Hodoku v2.3.0 to v2.3.2 allows attackers to execute arbitrary code. |
CVE-2024-53477 | Critical | 9.8 | 2024-12-02 | JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java |
CVE-2024-52338 | Critical | 9.8 | 2024-11-28 | Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An ap… |
CVE-2024-53673 | High | 8.1 | 2024-11-26 | A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code. |
CVE-2024-11145 | Critical | 9.8 | 2024-11-26 | Valor Apps Easy Folder Listing Pro has a deserialization vulnerability that allows an unauthenticated, remote attacker to execute arbitrary code with the privi… |
CVE-2024-11662 | Medium | 6.3 | 2024-11-25 | A vulnerability was found in welliamcao OpsManage 3.0.1/3.0.2/3.0.3/3.0.4/3.0.5. It has been rated as critical. This issue affects the function deploy_host_var… |
CVE-2024-53915 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24405. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-53914 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24344. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-53913 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24343. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-53912 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24341. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-53911 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24339. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-53910 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24336. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-53909 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24334. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-9511 | Critical | 9.8 | 2024-11-23 | The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to PHP Object Inj… |
CVE-2024-11394 | High | 8.8 | 2024-11-22 | Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu… |
CVE-2024-11393 | High | 8.8 | 2024-11-22 | Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… |
CVE-2024-11392 | High | 8.8 | 2024-11-22 | Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exec… |
CVE-2024-5580 | High | 7.2 | 2024-11-22 | Allegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2024-5579 | High | 7.2 | 2024-11-22 | Allegra renderFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2023-51642 | Medium | 6.3 | 2024-11-22 | Allegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2023-51641 | Medium | 6.3 | 2024-11-22 | Allegra renderFieldMatch Deserialization of Unstrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2024-11409 | High | 7.2 | 2024-11-21 | The Grid View Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0 via deserialization of untrusted inp… |
CVE-2018-9474 | High | 7.8 | 2024-11-20 | In writeToParcel of MediaPlayer.java, there is a possible serialization/deserialization mismatch due to improper input validation. This could lead to local esc… |
CVE-2024-10913 | High | 8.8 | 2024-11-20 | The Clone plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.6 via deserialization of untrusted input in the… |
CVE-2024-52445 | High | 8.8 | 2024-11-20 | Deserialization of Untrusted Data vulnerability in ModelTheme QRMenu Restaurant QR Menu Lite qrmenu-lite allows Object Injection.This issue affects QRMenu Rest… |