Insecure deserialization.

WordPress Roisin theme <= 1.4 - PHP Object Injection vulnerability

• Elated-Themes Roisin
• Insecure deserialization

WordPress Ashtanga theme <= 1.2 - PHP Object Injection vulnerability

• Mikado-Themes Ashtanga
• Insecure deserialization

WordPress LuxeDrive theme <= 1.4 - PHP Object Injection vulnerability

• Mikado-Themes LuxeDrive
• Insecure deserialization

WordPress Laurits theme <= 1.5.1 - PHP Object Injection vulnerability

• Edge-Themes Laurits
• Insecure deserialization

WordPress Micdrop theme <= 1.3.1 - PHP Object Injection vulnerability

• Select-Themes Micdrop
• Insecure deserialization

WordPress Valiance theme <= 1.2 - PHP Object Injection vulnerability

• Elated-Themes Valiance
• Insecure deserialization

WordPress Playroom theme <= 1.4.1 - PHP Object Injection vulnerability

• Elated-Themes Playroom
• Insecure deserialization

WordPress Santé theme <= 1.5.1 - PHP Object Injection vulnerability

• Select-Themes Santé
• Insecure deserialization

WordPress NeoBeat theme <= 1.7 - PHP Object Injection vulnerability

• Elated-Themes NeoBeat
• Insecure deserialization

WordPress Fidalgo theme <= 1.2.2 - PHP Object Injection vulnerability

• Elated-Themes Fidalgo
• Insecure deserialization

WordPress Alloggio - Hotel Booking theme <= 2.1.2 - PHP Object Injection vulnerability

• Edge-Themes Alloggio - Hotel Booking
• Insecure deserialization

WordPress Elementra theme <= 1.0.9 - PHP Object Injection vulnerability

• ThemeREX Group Elementra
• Insecure deserialization

WordPress Kapee theme < 1.7.0 - PHP Object Injection vulnerability

• PressLayouts Kapee
• Insecure deserialization

WordPress EmallShop theme <= 2.4.21 - PHP Object Injection vulnerability

• PressLayouts EmallShop
• Insecure deserialization

WordPress Nifty theme <= 1.4.1 - PHP Object Injection vulnerability

• BoldThemes Nifty
• Insecure deserialization

WordPress Fusion Builder plugin <= 3.15.3 - PHP Object Injection vulnerability

• ThemeFusion Fusion Builder
• Insecure deserialization

WordPress SeaFood Company theme <= 1.4 - PHP Object Injection vulnerability

• ThemeREX SeaFood Company
• Insecure deserialization

WordPress Hot Coffee theme <= 1.7 - PHP Object Injection vulnerability

• ThemeREX Hot Coffee
• Insecure deserialization

WordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerability

• ThemeFusion Fusion Builder
• Insecure deserialization

Deserialization of untrusted data in Oracle Corporation WebLogic Server

• Oracle Corporation WebLogic Server
• Insecure deserialization

Nexus Repository 3 - Remote Code Execution via License Deserialization

• Sonatype Nexus Repository
• Insecure deserialization

Deserialization of untrusted data in NVIDIA NeMo Framework

• NVIDIA NeMo Framework
• Insecure deserialization

Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc

• Insecure deserialization
• Denial of service

>=0.4.0, <1.0.0 · fixed in 1.0.0

SNMP4J-Agent allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component

• Path traversal
• Broken access control

<=3.8.3 · no fixed version yet

WordPress OttoKit plugin <= 1.1.27 - PHP Object Injection vulnerability

• Brainstorm Force OttoKit
• Insecure deserialization

WordPress WP Travel Engine plugin <= 6.7.12 - PHP Object Injection vulnerability

• WP Travel Engine
• Insecure deserialization

WordPress wpForo Forum plugin <= 3.1.0 - PHP Object Injection vulnerability

• Tomdever wpForo Forum
• Insecure deserialization

WordPress Happyforms plugin <= 1.26.13 - PHP Object Injection vulnerability

• Happyforms
• Insecure deserialization

WordPress Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.8 - PHP Object Injection vulnerability

• CRM Perks Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms
• Insecure deserialization

WordPress Integration for Contact Form 7 HubSpot plugin <= 1.3.7 - PHP Object Injection vulnerability

• CRM Perks Integration for Contact Form 7 HubSpot
• Insecure deserialization

WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.4.3 - PHP Object Injection vulnerability

• crm perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms
• Insecure deserialization

WordPress Integration for Contact Form 7 and Constant Contact plugin <= 1.1.6 - PHP Object Injection vulnerability

• CRM Perks Integration for Contact Form 7 and Constant Contact
• Insecure deserialization

WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability

• CRM Perks WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms
• Insecure deserialization

WordPress Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.2.1 - PHP Object Injection vulnerability

• CRM Perks Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms
• Insecure deserialization

WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability

• CRM Perks WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms
• Insecure deserialization

WordPress EventPrime plugin <= 4.3.2.1 - PHP Object Injection vulnerability

• EventPrime
• Insecure deserialization

WordPress Events Calendar for GeoDirectory plugin <= 2.3.25 - PHP Object Injection vulnerability

• Stiofan Events Calendar for GeoDirectory
• Insecure deserialization

WordPress Advanced Product Fields (Product Addons) for WooCommerce plugin <= 1.6.19 - PHP Object Injection vulnerability

• Wombat Plugins Advanced Product Fields (Product Addons) for WooCommerce
• Insecure deserialization

WordPress YayMail plugin <= 4.3.3 - PHP Object Injection vulnerability

• Yeeaddons YayMail
• Insecure deserialization

WordPress Modula Image Gallery plugin <= 2.14.18 - PHP Object Injection vulnerability

• WP Chill Modula Image Gallery
• Insecure deserialization

WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.87 - PHP Object Injection vulnerability

• Eli Scheetz Anti-Malware Security and Brute-Force Firewall
• Insecure deserialization

WordPress Post Duplicator plugin <= 3.0.10 - PHP Object Injection vulnerability

• metaphorcreations Post Duplicator
• Insecure deserialization

WordPress WooCommerce PDF Invoices & Packing Slips plugin < 5.9.0 - PHP Object Injection vulnerability

• WP Overnight WooCommerce PDF Invoices & Packing Slips
• Insecure deserialization

WordPress ShortPixel Image Optimizer plugin <= 6.4.3 - PHP Object Injection vulnerability

• ShortPixel Image Optimizer
• Insecure deserialization

WordPress CTX Feed plugin <= 6.6.26 - PHP Object Injection vulnerability

• WebAppick CTX Feed
• Insecure deserialization

WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Deserialization of untrusted data vulnerability

• VideoWhisper.com Paid Videochat Turnkey Site
• Insecure deserialization

WordPress Broadcast Live Video plugin < 7.1.3 - PHP Object Injection vulnerability

• VideoWhisper.com Broadcast Live Video
• Insecure deserialization

WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.1 - PHP Object Injection vulnerability

• CRM Perks Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms
• Insecure deserialization

Insecure Deserialisation via Plaintext HTTP leading to Remote Code Execution in Quick.CMS

• OpenSolution Quick.CMS
• Code injection
• Insecure deserialization

Comma AI Openpilot Pickle modeld.py pickle.loads deserialization

• Comma AI Openpilot
• Insecure deserialization
• CWE-20

TYPO3 CMS has Insecure Deserialization via Core API

• Insecure deserialization

<10.4.57 || >=11.0.0, <11.5.51 || >=12.0.0, <12.4.46 || >=13.0.0, <13.4.31 || >=14.0.0, <14.3.3 · fixed in 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3

Apache CXF JNDI Injection vulnerability in DispatchMDBMessageListenerImpl

• Insecure deserialization
• CWE-20

>=4.2.0, <4.2.2 || <4.1.7 · fixed in 4.2.2, 4.1.7

Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory

• Insecure deserialization
• CWE-20

>=4.2.0, <4.2.2 || >=4.1.0, <4.1.7 || <3.6.12 · fixed in 4.2.2, 4.1.7, 3.6.12

GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection

• Other injection
• Insecure deserialization

<2.27.0 · fixed in 2.27.0

Spring for GraphQL: Unsafe Deserialization

• Insecure deserialization

>=2.0.0, <2.0.4 || >=1.4.0, <1.4.6 || >=1.3.0, <=1.3.8 · fixed in 2.0.4, 1.4.6

Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway

• Splunk Enterprise
• Splunk Cloud Platform
• Insecure deserialization

Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation

• Insecure deserialization

<2.555.3 || >=2.556, <2.568 · fixed in 2.555.3, 2.568

Ghidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project Connection

• nationalsecurityagency ghidra
• Insecure deserialization

Concrete CMS: PHP Object Injection via unserialize() calls

• Insecure deserialization

<9.5.2 · fixed in 9.5.2

Insecure Deserialization via MITM in Layer 7 Policy Manager

• Broadcom Layer 7 API Gateway
• Insecure deserialization