CWE-502— Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.— MITRE CWE catalog
3,711 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-502page 18 of 75
- CVE-2024-49624CRITICALCVSS 9.8EG 9.82024-10-20
Deserialization of Untrusted Data vulnerability in smartdevth Advanced Advertising System advanced-advertising-system allows Object Injection.This issue affects Advanced Advertising System: from n/a through <= 1.3.1.
- CVE-2024-49332CRITICALCVSS 9.8EG 9.82024-10-20
Deserialization of Untrusted Data vulnerability in giveawayboost Giveaway Boost giveaway-boost allows Object Injection.This issue affects Giveaway Boost: from n/a through <= 2.1.4.
- CVE-2024-49626CRITICALCVSS 9.8EG 9.82024-10-20
Deserialization of Untrusted Data vulnerability in Piyush Patel Shipyaari Shipping Management shipyaari-shipping-managment allows Object Injection.This issue affects Shipyaari Shipping Management: from n/a through <= 1.2.
- CVE-2024-49318CRITICALCVSS 9.8EG 9.82024-10-17
Deserialization of Untrusted Data vulnerability in Scott My Reading Library my-reading-library allows Object Injection.This issue affects My Reading Library: from n/a through <= 1.0.
- CVE-2024-49227CRITICALCVSS 9.8EG 9.82024-10-16
Deserialization of Untrusted Data vulnerability in foter Free Stock Photos Foter free-stock-photos-foter allows Object Injection.This issue affects Free Stock Photos Foter: from n/a through <= 1.5.4.
- CVE-2024-49218CRITICALCVSS 9.8EG 9.82024-10-16
Deserialization of Untrusted Data vulnerability in Al Imran Akash Recently recently-viewed-most-viewed-and-sold-products-for-woocommerce allows Object Injection.This issue affects Recently: from n/a through <= 1.1.
- CVE-2024-48030CRITICALCVSS 9.8EG 9.82024-10-16
Deserialization of Untrusted Data vulnerability in Webextends Telecash Ricaricaweb telecash-ricaricaweb allows Object Injection.This issue affects Telecash Ricaricaweb: from n/a through <= 2.2.
- CVE-2024-48028CRITICALCVSS 9.8EG 9.82024-10-16
Deserialization of Untrusted Data vulnerability in Boyan Raichev IP Loc8 ip-loc8 allows Object Injection.This issue affects IP Loc8: from n/a through <= 1.1.
- CVE-2024-48026CRITICALCVSS 9.8EG 9.82024-10-16
Deserialization of Untrusted Data vulnerability in GMRobbins Disc Golf Manager disc-golf-manager allows Object Injection.This issue affects Disc Golf Manager: from n/a through <= 1.0.0.
- CVE-2024-9634CRITICALCVSS 9.8EG 9.82024-10-16
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.3 via deserialization of untrusted input from the give_company_name parameter. Th…
- CVE-2024-48033CRITICALCVSS 9.8EG 9.82024-10-11
Deserialization of Untrusted Data vulnerability in baptiste.gourdin Talkback talkback-secure-linkback-protocol allows Object Injection.This issue affects Talkback: from n/a through <= 1.0.
- CVE-2024-47074CRITICALCVSS 9.8EG 9.82024-10-11
DataEase is an open source data visualization analysis tool. In Dataease, the PostgreSQL data source in the data source function can customize the JDBC connection parameters and the PG server target to be connected. In backend/src/main/jav…
- CVE-2024-47636CRITICALCVSS 9.8EG 9.82024-10-10
Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch allows Object Injection.This issue affects JobSearch: from n/a through <= 2.5.9.
- CVE-2024-46983CRITICALCVSS 9.8EG 9.82024-09-19
sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there …
- CVE-2024-35515CRITICALCVSS 9.8EG 9.82024-09-18
Insecure deserialization in sqlitedict up to v2.1.0 allows attackers to execute arbitrary code.
- CVE-2024-22399CRITICALCVSS 9.8EG 9.82024-09-16
Deserialization of Untrusted Data vulnerability in Apache Seata. When developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests …
- CVE-2024-41874CRITICALCVSS 9.8EG 9.82024-09-13
ColdFusion versions 2023.9, 2021.15 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerabilit…
- CVE-2023-37227CRITICALCVSS 9.8EG 9.82024-09-10
Loftware Spectrum before 4.6 HF13 Deserializes Untrusted Data.
- CVE-2024-44902CRITICALCVSS 9.8EG 9.82024-09-09
A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
- CVE-2024-8255CRITICALCVSS 9.8EG 9.82024-08-29
Delta Electronics DTN Soft version 2.0.1 and prior are vulnerable to an attacker achieving remote code execution through a deserialization of untrusted data vulnerability.
- CVE-2024-43931CRITICALCVSS 9.8EG 9.82024-08-29
Deserialization of Untrusted Data vulnerability in eyecix JobSearch allows Object Injection.This issue affects JobSearch: from n/a through 2.5.3.
- CVE-2024-8030CRITICALCVSS 9.8EG 9.82024-08-28
The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the…
- CVE-2024-5335CRITICALCVSS 9.8EG 9.82024-08-21
The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the…
- CVE-2024-43354CRITICALCVSS 9.8EG 9.82024-08-19
Deserialization of Untrusted Data vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.7.2.
- CVE-2024-43141CRITICALCVSS 9.8EG 9.82024-08-13
Deserialization of Untrusted Data vulnerability in Roland Barker, xnau webdesign Participants Database allows Object Injection.This issue affects Participants Database: from n/a through 2.5.9.2.
- CVE-2024-6794CRITICALCVSS 9.8EG 9.82024-07-22
A deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabi…
- CVE-2024-6793CRITICALCVSS 9.8EG 9.82024-07-22
A deserialization of untrusted data vulnerability exists in NI VeriStand DataLogging Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabili…
- CVE-2024-40624CRITICALCVSS 9.8EG 9.82024-07-15
TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In `torrentpier/library/includes/functions.php`, `get_tracks()` uses the unsafe native PHP serialization format to deserialize user-controlled cookies.…
- CVE-2024-5488CRITICALCVSS 9.8EG 9.82024-07-09
The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, comprom…
- CVE-2024-39705CRITICALCVSS 9.8EG 9.82024-06-27
NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.
- CVE-2024-5871CRITICALCVSS 9.8EG 9.82024-06-15
The WooCommerce - Social Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'woo_slg_verify' vulnerable parameter. This makes it poss…
- CVE-2024-5671CRITICALCVSS 9.8EG 9.82024-06-14
Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitrary code execution and access to the vulnerable Trellix IPS Manager.
- CVE-2024-26289CRITICALCVSS 9.8EG 9.82024-05-27
Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: from 7.5.1 before 7.5.6-2, from 7.4.1 before 7.4.9, from 7.3.1 before 7.3.18.
- CVE-2024-4413CRITICALCVSS 9.8EG 9.82024-05-14
The Hotel Booking Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.11.1 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Obj…
- CVE-2024-3070CRITICALCVSS 9.8EG 9.82024-05-14
The Last Viewed Posts by WPBeginner plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization of untrusted input from the LastViewedPosts Cookie. This makes it possible for u…
- CVE-2024-26579CRITICALCVSS 9.8EG 9.82024-05-08
Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.11.0, the attackers can bypass using malicious parameters. Users are advised to upgrade to Apache InLong's 1.12.0 …
- CVE-2023-51576CRITICALCVSS 9.8EG 9.82024-05-03
Voltronic Power ViewPower Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower. Authentication is…
- CVE-2023-39476CRITICALCVSS 9.8EG 9.82024-05-03
Inductive Automation Ignition JavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automat…
- CVE-2023-39475CRITICALCVSS 9.8EG 9.82024-05-03
Inductive Automation Ignition ParameterVersionJavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of I…
- CVE-2024-1813CRITICALCVSS 9.8EG 9.82024-04-09
The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.11.0 via deserialization of untrusted input in the job_board_applicant_list_columns_value function. This makes it possi…
- CVE-2024-31224CRITICALCVSS 9.8EG 9.82024-04-08
GPT Academic provides interactive interfaces for large language models. A vulnerability was found in gpt_academic versions 3.64 through 3.73. The server deserializes untrustworthy data from the client, which may risk remote code execution.…
- CVE-2024-27604CRITICALCVSS 9.8EG 9.82024-04-02
Alldata V0.4.6 is vulnerable to Command execution vulnerability. System commands can be deserialized.
- CVE-2023-51570CRITICALCVSS 9.8EG 9.82024-04-01
Voltronic Power ViewPower Pro Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. Authentic…
- CVE-2024-29433CRITICALCVSS 9.8EG 9.82024-04-01
A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying crafted data.
- CVE-2024-28861CRITICALCVSS 9.8EG 9.82024-03-22
Symfony 1 is a community-driven fork of the 1.x branch of Symfony, a PHP framework for web projects. Starting in version 1.1.0 and prior to version 1.5.19, Symfony 1 has a gadget chain due to dangerous deserialization in `sfNamespacedParam…
- CVE-2024-2054CRITICALCVSS 9.8EG 9.82024-03-21
The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user.
- CVE-2024-28213CRITICALCVSS 9.8EG 9.82024-03-07
nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization.
- CVE-2024-28212CRITICALCVSS 9.8EG 9.82024-03-07
nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via unsafe deserialization.
- CVE-2024-28211CRITICALCVSS 9.8EG 9.82024-03-07
nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing arbitrary code via RMI registry by remote attacker.
- CVE-2024-24302CRITICALCVSS 9.8EG 9.82024-03-03
An issue was discovered in Tunis Soft "Product Designer" (productdesigner) module for PrestaShop before version 1.178.36, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the post…
Map vulnerabilities like CWE-502 to your infrastructure
EchelonGraph correlates every CVE — across CWE-502 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →