CWE-502: Deserialization of Untrusted Data

The Uncanny Automator WordPress plugin contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code t...

CVE-2025-42999 is a deserialization vulnerability in SAP NetWeaver Visual Composer Metadata Uploader that allows privileged users to upload malicious ...

This CVE describes a deserialization vulnerability in Adobe ColdFusion that allows attackers to execute arbitrary code without user interaction. Syste...

This CVE describes a fastjson deserialization vulnerability in MSFM that allows remote code execution by sending malicious payloads to the system/tabl...

This vulnerability allows remote code execution through fastjson deserialization in MSFM's table editing component. Attackers can exploit this to exec...

A deserialization vulnerability in Kibana allows authenticated attackers with specific Elasticsearch and Kibana privileges to execute arbitrary code b...

This vulnerability in H2O.ai H2O allows attackers to set arbitrary JDBC URLs, leading to deserialization attacks, file reads, and remote code executio...

The Events Calendar Pro WordPress plugin is vulnerable to PHP object injection through deserialization of untrusted input in the 'filters' parameter. ...

This CVE describes a deserialization vulnerability in Apache InLong that allows attackers to read arbitrary files from the server. The vulnerability a...

This CVE describes a deserialization vulnerability in Dataease's MySQL datasource component that allows attackers to bypass JDBC attack blacklists. Su...

This CVE describes a PHP object injection vulnerability in the HTML5 MP3 Player with Folder Feedburner Playlist Free WordPress plugin. Attackers can e...

This CVE describes a PHP object injection vulnerability in the HTML5 SoundCloud Player with Playlist Free WordPress plugin. Attackers can exploit dese...

This vulnerability allows remote attackers to execute arbitrary code via PHP object injection through deserialization of untrusted data in the HTML5 M...

This vulnerability allows attackers to execute arbitrary PHP code through insecure deserialization in the YITH WooCommerce Product Add-Ons plugin. It ...

CVE-2021-41110 is a critical deserialization vulnerability in cwlviewer that allows remote code execution by parsing malicious YAML data. The vulnerab...

CVE-2021-29508 is a deserialization vulnerability in Wire serialization library that allows attackers to execute arbitrary code by sending malicious p...

This CVE describes a remote code execution vulnerability in Taiga project management platform due to unsafe deserialization of untrusted data in the A...

This vulnerability allows unauthenticated attackers to execute arbitrary PHP code through deserialization of untrusted data in the Photography WordPre...

This CVE describes a deserialization vulnerability in Sitecore Experience Manager (XM) and Experience Platform (XP) that allows attackers to inject an...

This vulnerability allows authenticated users to execute arbitrary code remotely on affected systems by exploiting a flaw in the client-server communi...

CVE-2025-36038 is a critical deserialization vulnerability in IBM WebSphere Application Server that allows remote attackers to execute arbitrary code ...

CVE-2025-5086 is a deserialization vulnerability in Dassault Systèmes DELMIA Apriso that allows remote attackers to execute arbitrary code by sending...

This vulnerability allows remote attackers to execute arbitrary code via PHP object injection in the Traveler WordPress theme. It affects WordPress si...

CVE-2025-29783 is a remote code execution vulnerability in vLLM when configured with Mooncake for distributed key-value storage. Attackers can exploit...

This vulnerability allows remote code execution on Apache Ignite servers by bypassing class serialization filters. Attackers can craft malicious messa...

SolarWinds Access Rights Manager (ARM) contains a deserialization vulnerability (CWE-502) that allows authenticated users to execute arbitrary code re...

CVE-2024-43252 is a PHP object injection vulnerability in the Crew HRM WordPress plugin that allows attackers to execute arbitrary code through deseri...

This vulnerability allows unauthenticated attackers to perform PHP object injection via the recently_viewed_products cookie in the CoDesigner WooComme...

An unsafe .NET object deserialization vulnerability in DELMIA Apriso allows attackers to execute arbitrary code without authentication. This affects a...

This vulnerability allows authenticated users of SolarWinds Access Rights Manager to execute arbitrary code remotely on affected systems. Attackers wi...

CVE-2024-33553 is an unauthenticated PHP object injection vulnerability in the XStore Core WordPress plugin. Attackers can exploit deserialization of ...

CVE-2024-30223 is an unauthenticated PHP object injection vulnerability in the ARMember WordPress plugin. Attackers can exploit this by sending specia...

This CVE describes a PHP object injection vulnerability in the INFINITUM FORM Geo Controller WordPress plugin due to insecure deserialization of untru...

CVE-2023-45146 is a critical remote code execution vulnerability in XXL-RPC when configured with Netty and Hessian serialization. Attackers can send m...