CWE-502— Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.— MITRE CWE catalog
3,715 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-502page 66 of 75
- CVE-2024-5579HIGHCVSS 7.2EG 7.22024-11-22
Allegra renderFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is required to exploi…
- CVE-2024-11409HIGHCVSS 7.2EG 7.22024-11-21
The Grid View Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0 via deserialization of untrusted input from cs_all_photos_details parameter. This makes it possible for authenticate…
- CVE-2024-49684HIGHCVSS 7.2EG 7.22024-10-23
Deserialization of Untrusted Data vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Object Injection.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.21.
- CVE-2024-9314HIGHCVSS 7.2EG 7.22024-10-05
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.228 via deserialization of untrusted input 'set_redirections' function. This m…
- CVE-2024-43191HIGHCVSS 7.2EG 7.22024-09-26
IBM ManageIQ could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted yaml file request.
- CVE-2022-2439HIGHCVSS 7.2EG 7.22024-09-24
The Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress is vulnerable to deserialization of untrusted input via the 'upload[file]' parameter in versions up to, and including 3.3.3. This makes it possi…
- CVE-2022-2446HIGHCVSS 7.2EG 7.22024-09-13
The WP Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'current_theme_root' parameter in versions up to, and including 1.2.9. This makes it possible for authenticated attackers with administrative pr…
- CVE-2022-2440HIGHCVSS 7.2EG 7.22024-08-29
The Theme Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'images_array' parameter in versions up to, and including 2.8. This makes it possible for authenticated attackers with administrative privile…
- CVE-2024-7351HIGHCVSS 7.2EG 7.22024-08-24
The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.3 via deserialization of untrusted input when editing job applications. This makes it possible for authenticated att…
- CVE-2024-7560HIGHCVSS 7.2EG 7.22024-08-08
The News Flash theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input from the newsflash_post_meta meta value. This makes it possible for authenticated a…
- CVE-2024-5016HIGHCVSS 7.2EG 7.22024-06-25
In WhatsUp Gold versions released before 2023.1.3, Distributed Edition installations can be exploited by using a deserialization tool to achieve a Remote Code Execution as SYSTEM. The vulnerability exists in the main message processing …
- CVE-2024-2290HIGHCVSS 7.2EG 7.22024-05-14
The Advanced Ads plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.52.1 via deserialization of untrusted input in the 'placement_slug' parameter. This makes it possible for authenticated att…
- CVE-2024-3020HIGHCVSS 7.2EG 7.22024-04-10
The plugin is vulnerable to PHP Object Injection in versions up to and including, 2.6.3 via deserialization of untrusted input in the import function via the 'shortcode' parameter. This allows authenticated attackers, with administrator-le…
- CVE-2023-46154HIGHCVSS 7.2EG 7.22023-12-19
Deserialization of Untrusted Data vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress.This issue affects E2Pdf – Export To Pdf Tool for WordPress: from n/a through 1.20.18.
- CVE-2023-4971HIGHCVSS 7.2EG 7.22023-10-16
The Weaver Xtreme Theme Support WordPress plugin before 6.3.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is…
- CVE-2023-3392HIGHCVSS 7.2EG 7.22023-10-16
The Read More & Accordion WordPress plugin before 3.2.7 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
- CVE-2023-4314HIGHCVSS 7.2EG 7.22023-09-11
The wpDataTables WordPress plugin before 2.1.66 does not validate the "Serialized PHP array" input data before deserializing the data. This allows admins to deserialize arbitrary data which may lead to remote code execution if a suitable g…
- CVE-2023-1549HIGHCVSS 7.2EG 7.22023-05-15
The Ad Inserter WordPress plugin before 2.7.27 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
- CVE-2023-20878HIGHCVSS 7.2EG 7.22023-05-12
VMware Aria Operations contains a deserialization vulnerability. A malicious actor with administrative privileges can execute arbitrary commands and disrupt the system.
- CVE-2023-1347HIGHCVSS 7.2EG 7.22023-05-08
The Customizer Export/Import WordPress plugin before 0.9.6 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
- CVE-2023-1669HIGHCVSS 7.2EG 7.22023-05-02
The SEOPress WordPress plugin before 6.5.0.3 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
- CVE-2022-47507HIGHCVSS 7.2EG 7.22023-02-15
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
- CVE-2023-21710HIGHCVSS 7.2EG 7.22023-02-14
Microsoft Exchange Server Remote Code Execution Vulnerability
- CVE-2023-21703HIGHCVSS 7.2EG 7.22023-02-14
Azure Data Box Gateway Remote Code Execution Vulnerability
- CVE-2022-4489HIGHCVSS 7.2EG 7.22023-02-06
The HUSKY WordPress plugin before 1.3.2 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
- CVE-2022-4680HIGHCVSS 7.2EG 7.22023-01-30
The Revive Old Posts WordPress plugin before 9.0.11 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
- CVE-2022-4323HIGHCVSS 7.2EG 7.22023-01-23
The Analyticator WordPress plugin before 6.5.6 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
- CVE-2022-3425HIGHCVSS 7.2EG 7.22023-01-23
The Analyticator WordPress plugin before 6.5.6 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
- CVE-2022-4043HIGHCVSS 7.2EG 7.22023-01-09
The WP Custom Admin Interface WordPress plugin before 7.29 unserialize user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
- CVE-2022-4324HIGHCVSS 7.2EG 7.22023-01-02
The Custom Field Template WordPress plugin before 2.5.8 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling …
- CVE-2022-4302HIGHCVSS 7.2EG 7.22023-01-02
The White Label CMS WordPress plugin before 2.5 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
- CVE-2022-3490HIGHCVSS 7.2EG 7.22022-11-28
The Checkout Field Editor (Checkout Manager) for WooCommerce WordPress plugin before 1.8.0 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suita…
- CVE-2022-3380HIGHCVSS 7.2EG 7.22022-10-31
The Customizer Export/Import WordPress plugin before 0.9.5 unserializes the content of an imported file, which could lead to PHP object injection issues when an admin imports (intentionally or not) a malicious file and a suitable gadget ch…
- CVE-2022-3374HIGHCVSS 7.2EG 7.22022-10-31
The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling file and a…
- CVE-2022-3366HIGHCVSS 7.2EG 7.22022-10-31
The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported files, which could lead to PHP object injection attacks by administrators, on mul…
- CVE-2022-3334HIGHCVSS 7.2EG 7.22022-10-31
The Easy WP SMTP WordPress plugin before 1.5.0 unserialises the content of an imported file, which could lead to PHP object injection issue when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present…
- CVE-2022-3335HIGHCVSS 7.2EG 7.22022-10-25
The Kadence WooCommerce Email Designer WordPress plugin before 1.5.7 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable…
- CVE-2022-36957HIGHCVSS 7.2EG 7.22022-10-20
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
- CVE-2022-2903HIGHCVSS 7.2EG 7.22022-09-26
The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget c…
- CVE-2022-2442HIGHCVSS 7.2EG 7.22022-09-06
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to deserialization of untrusted input via the 'path' parameter in versions up to, and including 0.9.74. This makes it possible for authenticated attackers with…
- CVE-2022-2438HIGHCVSS 7.2EG 7.22022-09-06
The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up to, and including 1.11.16. This makes it possible for authenticated attackers with administrative pri…
- CVE-2022-22958HIGHCVSS 7.2EG 7.22022-04-13
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untruste…
- CVE-2022-22957HIGHCVSS 7.2EG 7.22022-04-13
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untruste…
- CVE-2022-1032HIGHCVSS 7.2EG 7.22022-03-29
Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6.
- CVE-2022-24282HIGHCVSS 7.2EG 7.22022-03-08
A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The affected system allows to upload JSON objects that are deserialized to Java objects.…
- CVE-2022-21828HIGHCVSS 7.2EG 7.22022-03-04
A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a unspecified attack vector in Incapptic Connect version 1.40.0, 1.39.1, 1.39.0, 1.38.1, 1.38.0, 1.37.1,…
- CVE-2021-20318HIGHCVSS 7.2EG 7.22021-12-23
The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage.
- CVE-2021-33728HIGHCVSS 7.2EG 7.22021-10-12
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to upload JSON objects that are deserialized to JAVA objects. Due to insecure deserialization of user-supplied content by the a…
- CVE-2021-38585HIGHCVSS 7.2EG 7.22021-08-11
The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).
- CVE-2021-36766HIGHCVSS 7.2EG 7.22021-07-30
Concrete5 through 8.5.5 deserializes Untrusted Data. The vulnerable code is located within the controllers/single_page/dashboard/system/environment/logging.php Logging::update_logging() method. User input passed through the logFile request…
Map vulnerabilities like CWE-502 to your infrastructure
EchelonGraph correlates every CVE — across CWE-502 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →