CWE-502— Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.— MITRE CWE catalog

3,714 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-502page 63 of 75

CVE-2025-3425HIGHCVSS 7.3EG 7.3
2025-04-07
The IntelliSpace portal application utilizes .NET Remoting for its functionality. The vulnerability arises from the exploitation of port 755 through the deserialization vulnerability. After analyzing the configuration files, we observed th…
CVE-2025-2376HIGHCVSS 7.3EG 7.3
2025-03-17
A vulnerability has been found in viames Pair Framework up to 1.9.11 and classified as critical. Affected by this vulnerability is the function getCookieContent of the file /src/UserRemember.php of the component PHP Object Handler. The man…
CVE-2025-0841HIGHCVSS 7.3EG 7.3
2025-01-29
A vulnerability has been found in Aridius XYZ up to 20240927 on OpenCart and classified as critical. This vulnerability affects the function loadMore of the component News. The manipulation leads to deserialization. The attack can be initi…
CVE-2025-0465HIGHCVSS 7.3EG 7.3
2025-01-14
A vulnerability was found in AquilaCMS 1.412.13. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/v2/categories. The manipulation of the argument PostBody.populate leads to deserializatio…
CVE-2023-32736HIGHCVSS 7.3EG 7.3
2024-11-12
A vulnerability has been identified in SIMATIC S7-PLCSIM V16 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 Safety V16 (All versions), SIMATIC STEP 7 Safety V17 (All versions < V17 Update 8), SIMATIC STEP 7 Safety V18…
CVE-2024-9005HIGHCVSS 7.3EG 7.3
2024-10-08
CWE-502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely deserialized data is posted to the web server.
CVE-2024-8862HIGHCVSS 7.3EG 7.3
2024-09-14
A vulnerability, which was classified as critical, has been found in h2oai h2o-3 3.46.0.4. This issue affects the function getConnectionSafe of the file /dtale/chart-data/1 of the component JDBC Connection Handler. The manipulation of the …
CVE-2024-1225HIGHCVSS 7.3EG 7.3
2024-02-05
A vulnerability classified as critical was found in QiboSoft QiboCMS X1 up to 1.0.6. Affected by this vulnerability is the function rmb_pay of the file /application/index/controller/Pay.php. The manipulation of the argument callback_class …
CVE-2024-1032HIGHCVSS 7.3EG 7.3
2024-01-30
A vulnerability classified as critical was found in openBI up to 1.0.8. Affected by this vulnerability is the function testConnection of the file /application/index/controller/Databasesource.php of the component Test Connection Handler. Th…
CVE-2024-0739HIGHCVSS 7.3EG 7.3
2024-01-19
A vulnerability, which was classified as critical, was found in Hecheng Leadshop up to 1.4.20. Affected is an unknown function of the file /web/leadshop.php. The manipulation of the argument install leads to deserialization. It is possible…
CVE-2024-0603HIGHCVSS 7.3EG 7.3
2024-01-16
A vulnerability classified as critical has been found in ZhiCms up to 4.0. This affects an unknown part of the file app/plug/controller/giftcontroller.php. The manipulation of the argument mylike leads to deserialization. It is possible to…
CVE-2023-21568HIGHCVSS 7.3EG 7.3
2023-02-14
Microsoft SQL Server Integration Service (VS extension) Remote Code Execution Vulnerability
CVE-2022-41958HIGHCVSS 7.3EG 7.3
2022-11-25
super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yaml file. An attacker with local access to the file could exploit this and compromise the program. Th…
CVE-2021-40843HIGHCVSS 7.3EG 7.3
2021-10-13
Proofpoint Insider Threat Management Server contains an unsafe deserialization vulnerability in the Web Console. An attacker with write access to the local database could cause arbitrary code to execute with SYSTEM privileges on the underl…
CVE-2020-12525HIGHCVSS 7.3EG 7.3
2021-01-22
M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage.
CVE-2019-10086HIGHCVSS 7.3EG 7.3
2019-08-20
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using t…
CVE-2016-4385HIGHCVSS 7.3EG 7.3
2016-09-29
The RMI service in HP Network Automation Software 9.1x, 9.2x, 10.0x before 10.00.02.01, and 10.1x before 10.11.00.01 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons …
CVE-2026-40993HIGHCVSS 7.2EG 7.3
2026-06-10
An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verifi…
CVE-2023-4528HIGHCVSS 7.2EG 7.3
2023-09-07
Unsafe deserialization in JSCAPE MFT Server versions prior to 2023.1.9 (Windows, Linux, and MacOS) permits an attacker to run arbitrary Java code (including OS commands) via its management interface
CVE-2026-118089HIGHCVSS 7.2EG 7.2
2026-10-30
Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.
CVE-2026-118079HIGHCVSS 7.2EG 7.2
2026-10-29
Deserialization of Untrusted Data vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Object Injection.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212.
CVE-2026-118078HIGHCVSS 7.2EG 7.2
2026-10-29
Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.
CVE-2026-118077HIGHCVSS 7.2EG 7.2
2026-10-29
Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.
CVE-2026-118074HIGHCVSS 7.2EG 7.2
2026-10-29
Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.
CVE-2026-116869HIGHCVSS 7.2EG 7.2
2026-10-29
Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.
CVE-2026-116865HIGHCVSS 7.2EG 7.2
2026-10-29
Editor PHP Object Injection in Zippy <= 1.7.0 versions.
CVE-2026-116864HIGHCVSS 7.2EG 7.2
2026-10-29
Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.
CVE-2026-42701HIGHCVSS 7.2EG 7.2
2026-10-29
Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.
CVE-2026-116390HIGHCVSS 7.2EG 7.2
2026-10-28
Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & WooCommerce Filters filter-everything allows Object Injection.This issue affects Filter Everything — WordPress & WooCommerce…
CVE-2026-115590HIGHCVSS 7.2EG 7.2
2026-10-28
Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allows Object Injection.This issue affects Dokan: from n/a through 5.3.1.
CVE-2026-116392HIGHCVSS 7.2EG 7.2
2026-10-28
Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through 2.3.25.
CVE-2026-114704HIGHCVSS 7.2EG 7.2
2026-10-24
Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.
CVE-2026-114624HIGHCVSS 7.2EG 7.2
2026-10-23
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API…
CVE-2026-29001HIGHCVSS 7.2EG 7.2
2026-10-21
TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and…
CVE-2026-104734HIGHCVSS 7.2EG 7.2
2026-10-17
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for au…
CVE-2026-97278HIGHCVSS 7.2EG 7.2
2026-10-14
Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.
CVE-2026-104764HIGHCVSS 7.2EG 7.2
2026-10-14
The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with adm…
CVE-2026-62130HIGHCVSS 7.2EG 7.2
2026-10-10
Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.
CVE-2026-62044HIGHCVSS 7.2EG 7.2
2026-10-10
Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13.
CVE-2026-94676HIGHCVSS 7.2EG 7.2
2026-10-10
Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Object Injection.This issue affects Tainacan: from n/a through 1.3.0.
CVE-2026-106606HIGHCVSS 7.2EG 7.2
2026-10-10
Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue affects YITH WooCommerce Affiliates: from n/a through 3.31.0.
CVE-2026-12626HIGHCVSS 7.2EG 7.2
2026-10-10
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 28.2 via deserialization of untrusted input via the ‘value’ parameter. Thi…
CVE-2026-105872HIGHCVSS 7.2EG 7.2
2026-10-09
Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5.
CVE-2026-94568HIGHCVSS 7.2EG 7.2
2026-10-09
Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-vipps allows Object Injection.This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.0.
CVE-2026-100506HIGHCVSS 7.2EG 7.2
2026-10-05
Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects WP Spell Check: from n/a through 12.1.
CVE-2026-93617HIGHCVSS 7.2EG 7.2
2026-10-05
Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1.
CVE-2026-103348HIGHCVSS 7.2EG 7.2
2026-10-05
Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0.
CVE-2026-103349HIGHCVSS 7.2EG 7.2
2026-10-05
Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7.
CVE-2026-94390HIGHCVSS 7.2EG 7.2
2026-10-01
Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.
CVE-2026-102108HIGHCVSS 7.2EG 7.2
2026-09-30
An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execut…

Map vulnerabilities like CWE-502 to your infrastructure

EchelonGraph correlates every CVE — across CWE-502 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →