Insecure deserialization.

Duplicate Advisory: Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization

• Insecure deserialization

<26.4.6 · fixed in 26.4.6

An issue in the cms_rest.php component of SIGB PMB v8.0.1.14 allows attackers to execute arbitrary code via unserializing an arbitrary file.

• Insecure deserialization

An issue was discovered in jishenghua JSH_ERP 2.3.1.

• Insecure deserialization

An issue was discovered in jishenghua JSH_ERP 2.3.1.

• Insecure deserialization

An issue was discovered in jishenghua JSH_ERP 2.3.1.

• Insecure deserialization

An issue was discovered in jishenghua JSH_ERP 2.3.1.

• Insecure deserialization

An issue was discovered in jishenghua JSH_ERP 2.3.1.

• Insecure deserialization

WordPress WP Webhooks plugin <= 3.3.8 - PHP Object Injection vulnerability

• Cozmoslabs WP Webhooks
• Insecure deserialization

WordPress Email Subscribers & Newsletters plugin <= 5.9.10 - PHP Object Injection vulnerability

• Icegram Email Subscribers & Newsletters
• Insecure deserialization

Microsoft SharePoint Online Elevation of Privilege Vulnerability

• Microsoft SharePoint Online
• Insecure deserialization

IBM webMethods Integration Deserialization

• IBM webMethods Integration
• Insecure deserialization

vLLM deserialization vulnerability leading to DoS and potential RCE

• Insecure deserialization
• Memory corruption

>=0.10.2, <0.11.1 · fixed in 0.11.1

Apache Causeway vulnerable to deserialization in Java

• Insecure deserialization

<3.5.0 · fixed in 3.5.0

WP Import – Ultimate CSV XML Importer for WordPress <= 7.33.1 - Authenticated (Administrator+) PHP Object Injection via CSV Import

• smackcoders WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress
• Insecure deserialization

Modular Max Serve has Unsafe Deserialization vulnerability

• Insecure deserialization

<25.6.0 · fixed in 25.6.0

AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization

• tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress
• Insecure deserialization

Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vect...

• Insecure deserialization
• Broken access control

>=8.0.0, <10.4.9 || >=10.5.0, <10.5.6 || >=11.0.0, <11.1.9 || >=11.2.0, <11.2.8 · fixed in 10.4.9, 10.5.6, 11.1.9, 11.2.8

N-central windows software probe Remote Code Execution

• N-able N-central
• Insecure deserialization

Microsoft SharePoint Remote Code Execution Vulnerability

• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Server 2019
• Insecure deserialization

ktg-mes before commit a484f96 (2025-07-03) has a fastjson deserialization vulnerability.

• Insecure deserialization

Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses'

• kodezen Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
• Insecure deserialization

Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc

• Insecure deserialization
• Broken access control

<20251230 · fixed in 20251230

Arbitrary Code Execution in pdfminer.six via Crafted PDF Input

• Insecure deserialization

<20251107 · fixed in 20251107

WordPress Togo theme < 1.0.4 - PHP Object Injection vulnerability

• uxper Togo
• Insecure deserialization

WordPress WP User Manager plugin <= 2.9.12 - PHP Object Injection vulnerability

• WP User Manager
• Insecure deserialization

WordPress s2Member Plugin <= 250701 - PHP Object Injection Vulnerability

• Cristián Lávaque s2Member
• Insecure deserialization

WordPress WP Gravity Forms Keap/Infusionsoft Plugin <= 1.2.3 - Deserialization of untrusted data Vulnerability

• CRM Perks WP Gravity Forms Keap/Infusionsoft
• Insecure deserialization

WordPress Falang multilanguage Plugin <= 1.3.65 - PHP Object Injection Vulnerability

• sbouey Falang multilanguage
• Insecure deserialization

WordPress TranslatePress Plugin <= 2.10.2 - Deserialization of untrusted data Vulnerability

• Cozmoslabs TranslatePress
• Insecure deserialization

WordPress Yogi - Health Beauty & Yoga Theme <= 2.9.2 - Deserialization of untrusted data Vulnerability

• NooTheme Yogi - Health Beauty & Yoga
• Insecure deserialization

WordPress WeMusic Theme <= 1.9.1 - PHP Object Injection Vulnerability

• NooTheme WeMusic
• Insecure deserialization

WordPress Seil Theme <= 1.7.1 - Deserialization of untrusted data Vulnerability

• VictorThemes Seil
• Insecure deserialization

WordPress Sign-up Sheets Plugin <= 2.3.2 - PHP Object Injection Vulnerability

• Fetch Designs Sign-up Sheets
• Insecure deserialization

WordPress Preserve Code Formatting Plugin <= 4.0.1 - PHP Object Injection Vulnerability

• Scott Reilly Preserve Code Formatting
• Insecure deserialization

WordPress Ajax Search Lite plugin <= 4.13.3 - PHP Object Injection vulnerability

• wpdreams Ajax Search Lite
• Insecure deserialization

DataEase is vulnerable to Oracle JNDI Injection

• dataease
• Insecure deserialization

LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer

• Insecure deserialization

<3.0.0 · fixed in 3.0.0

Everest Forms (Pro) <= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form Signature

• WPEverest Everest Forms Pro
• Insecure deserialization

WordPress Polylang plugin <= 3.7.3 - Deserialization of untrusted data vulnerability

• Chouby Polylang
• Insecure deserialization

cryptidy allows code execution via untrusted data due to pickle.loads

• Insecure deserialization

<=1.2.4 · no fixed version yet

Keras is vulnerable to arbitrary local file loading and Server-Side Request Forgery

• Insecure deserialization
• Server-side request forgery (SSRF)

<3.12.0 · fixed in 3.12.0

Taiga Authenticated Remote Code Execution

• taigaio taiga-back
• Insecure deserialization

quequnlong shiyi-blog Job SysJobController.java deserialization

• quequnlong shiyi-blog
• Insecure deserialization
• CWE-20

BeWelcome/Rox PHP Object Injection RCE

• BeWelcome Rox
• Insecure deserialization

The Utils.deserialize function in pgCodeKeeper 10.12.0 processes serialized data from untrusted sources.

• Insecure deserialization

Scapy Session Loading Vulnerable to Arbitrary Code Execution via Untrusted Pickle Deserialization

• Insecure deserialization

<=2.6.1 · no fixed version yet

WordPress JobSearch plugin < 3.0.8 - PHP Object Injection vulnerability

• eyecix JobSearch
• Insecure deserialization

WordPress Product Table For WooCommerce plugin <= 1.2.4 - PHP Object Injection vulnerability

• acowebs Product Table For WooCommerce
• Insecure deserialization

WordPress UNIVERSAM plugin <= 9.04.02 - PHP Object Injection vulnerability

• UNIVERSAM
• Insecure deserialization

WordPress Single Property theme <= 2.8 - PHP Object Injection vulnerability

• designthemes Single Property
• Insecure deserialization

WordPress KBx Pro Ultimate plugin <= 8.0.5 - PHP Object Injection vulnerability

• quantumcloud KBx Pro Ultimate
• Insecure deserialization

WordPress Knowledge Base theme <= 2.9 - PHP Object Injection vulnerability

• designthemes Knowledge Base
• Insecure deserialization

WordPress White Rabbit theme <= 1.5.2 - PHP Object Injection vulnerability

• axiomthemes White Rabbit
• Insecure deserialization

WordPress BugsPatrol theme <= 1.5.0 - PHP Object Injection vulnerability

• AncoraThemes BugsPatrol
• Insecure deserialization

WordPress Subscribe to Download plugin <= 2.0.9 - PHP Object Injection vulnerability

• wpshuffle Subscribe to Download
• Insecure deserialization

WordPress Captivate Sync Plugin <= 3.0.3 - PHP Object Injection Vulnerability

• captivateaudio Captivate Sync
• Insecure deserialization

WordPress Addison theme < 1.4.8 - PHP Object Injection vulnerability

• BoldThemes Addison
• Insecure deserialization

WordPress Kriya theme <= 3.4 - PHP Object Injection Vulnerability

• designthemes Kriya
• Insecure deserialization

WordPress Goldenblatt theme < 1.3.0 - PHP Object Injection vulnerability

• BoldThemes Goldenblatt
• Insecure deserialization

WordPress Scape theme <= 1.5.13 - PHP Object Injection vulnerability

• Whitebox-Studio Scape
• Insecure deserialization