Insecure deserialization.

SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)

• Insecure deserialization
• Denial of service

>=2.49.0, <2.53.3 · fixed in 2.53.3

Unsafe Deserialization of Erlang Terms in hex_core

• Denial of service
• Insecure deserialization

>=0.1.0, <0.12.1 · fixed in 0.12.1

Deserialization of untrusted data in NTT DATA INTRAMART Corporation intra-mart Accel Platform

• NTT DATA INTRAMART Corporation intra-mart Accel Platform
• Insecure deserialization

Deserialization of untrusted data in Flair

• Flair
• Insecure deserialization

WordPress uListing plugin <= 2.2.0 - PHP Object Injection vulnerability

• Stylemix uListing
• Insecure deserialization

LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution

• Insecure deserialization

<4.0.0 · fixed in 4.0.0

c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

• Code injection
• Insecure deserialization

<0.12.0 · fixed in 0.12.0

mchange-commons-java: Remote Code Execution via JNDI Reference Resolution

• Other injection
• Insecure deserialization

<0.4.0 · fixed in 0.4.0

DocLink .NET Remoting Unauthenticated Arbitrary File Read/Write RCE

• Beyond Limits Inc. Altec DocLink
• Insecure deserialization
• Server-side request forgery (SSRF)

Deserialization of untrusted data in Fiserv Originate Loans Peripherals (formerly Velocity Services) -- Print…

• Fiserv Originate Loans Peripherals (formerly Velocity Services) -- Print Service component
• Insecure deserialization

Apache Camel Deserializes Untrusted Data in its LevelDB Component

• Insecure deserialization

>=3.0.0, <4.10.9 || >=4.11.0, <4.14.5 || >=4.15.0, <4.18.0 · fixed in 4.10.9, 4.14.5, 4.18.0

datapizza-ai has unsafe deserialization via pickle.loads() in RedisCache

• Insecure deserialization
• CWE-20

<=0.0.7 · no fixed version yet

funadmin: Deserialization Vulnerability in Backend Endpoint via AuthCloudService getMember Function

• Insecure deserialization
• CWE-20

<=7.1.0-rc4 · no fixed version yet

GFI Archiver MArc.Store Deserialization of Untrusted Data Remote Code Execution Vulnerability

• GFI Archiver
• Insecure deserialization

GFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution Vulnerability

• GFI Archiver
• Insecure deserialization

openITCOCKPIT has Unsafe Deserialization in openITCOCKPIT Changelog Handling

• openITCOCKPIT
• Insecure deserialization

openITCOCKPIT has Unsafe PHP Deserialization in Gearman Worker Allowing Conditional Object Injection

• openITCOCKPIT
• Insecure deserialization

WordPress Applay - Shortcodes plugin <= 3.7 - PHP Object Injection vulnerability

• leafcolor Applay - Shortcodes
• Insecure deserialization

WordPress Woocommerce Category Banner Management plugin <= 2.5.1 - PHP Object Injection vulnerability

• Dotstore Woocommerce Category Banner Management
• Insecure deserialization

WordPress Slider Responsive Slideshow – Image slider, Gallery slideshow plugin <= 1.5.4 - PHP Object Injection vulnerability

• A WP Life Slider Responsive Slideshow – Image slider, Gallery slideshow
• Insecure deserialization

WordPress Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery plugin <= 1.6.0 - PHP Object Injection vulnerability

• A WP Life Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery
• Insecure deserialization

WordPress Lorem Ipsum | Books & Media Store theme <= 1.2.11 - PHP Object Injection vulnerability

• ThemeREX Lorem Ipsum | Books & Media Store
• Insecure deserialization

WordPress Extreme Store theme <= 1.5.10 - PHP Object Injection vulnerability

• ThemeREX Extreme Store
• Insecure deserialization

WordPress Themesflat Elementor plugin <= 1.0.1 - PHP Object Injection vulnerability

• Themesflat Elementor
• Insecure deserialization

WordPress SevenHills theme <= 1.6.2 - PHP Object Injection vulnerability

• AncoraThemes SevenHills
• Insecure deserialization

WordPress KindlyCare theme <= 1.6.1 - PHP Object Injection vulnerability

• AncoraThemes KindlyCare
• Insecure deserialization

WordPress Capella theme <= 2.5.5 - PHP Object Injection vulnerability

• ThemeGoods Capella
• Insecure deserialization

WordPress Prestige theme < 1.4.1 - PHP Object Injection vulnerability

• Jthemes Prestige
• Insecure deserialization

WordPress Booking and Rental Manager plugin <= 2.5.9 - PHP Object Injection vulnerability

• magepeopleteam Booking and Rental Manager
• Insecure deserialization

WordPress PhotoMe theme <= 5.6.11 - PHP Object Injection vulnerability

• ThemeGoods PhotoMe
• Insecure deserialization

WordPress PeakShops theme <= 1.5.9 - PHP Object Injection vulnerability

• fuelthemes PeakShops
• Insecure deserialization

WordPress Contact Manager plugin <= 9.1.1 - PHP Object Injection vulnerability

• Kleor Contact Manager
• Insecure deserialization

WordPress Ippsum theme <= 1.2.0 - PHP Object Injection vulnerability

• BoldThemes Ippsum
• Insecure deserialization

WordPress ModelTheme Addons for WPBakery and Elementor plugin < 1.5.6 - PHP Object Injection vulnerability

• ModelTheme Addons for WPBakery and Elementor
• Insecure deserialization

WordPress Modal Popup Box plugin <= 1.6.1 - PHP Object Injection vulnerability

• A WP Life Modal Popup Box
• Insecure deserialization

WordPress Travelicious theme < 1.6.7 - PHP Object Injection vulnerability

• BoldThemes Travelicious
• Insecure deserialization

WordPress Nestin theme < 1.2.6 - PHP Object Injection vulnerability

• BoldThemes Nestin
• Insecure deserialization

WordPress PatioTime theme < 2.1 - PHP Object Injection vulnerability

• LoftOcean PatioTime
• Insecure deserialization

Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()

• Insecure deserialization

<3.2.3 · fixed in 3.2.3

WordPress CartFlows plugin <= 2.1.19 - PHP Object Injection vulnerability

• Brainstorm Force CartFlows
• Insecure deserialization

WordPress WpEvently plugin <= 5.1.1 - PHP Object Injection vulnerability

• magepeopleteam WpEvently
• Insecure deserialization

WordPress Valenti theme <= 5.6.3.5 - PHP Object Injection vulnerability

• codetipi Valenti
• Insecure deserialization

WordPress Grand Restaurant theme <= 7.0.10 - PHP Object Injection vulnerability

• ThemeGoods Grand Restaurant
• Insecure deserialization

WordPress YITH WooCommerce Compare plugin <= 3.6.0 - Deserialization of untrusted data vulnerability

• YITHEMES YITH WooCommerce Compare
• Insecure deserialization

NVIDIA NeMo Framework Deserializes Untrusted Data

• Insecure deserialization

<2.6.1 · fixed in 2.6.1

NVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution

• Insecure deserialization

<2.6.1 · fixed in 2.6.1

An Insecure Deserialization vulnerability has been discovered in OpenText™ Directory Services.

• OpenText™ Directory Services
• Insecure deserialization

Advanced AJAX Product Filters <= 3.1.9.6 - Authenticated (Author+) PHP Object Injection via Live Composer Compatibility

• berocket Advanced AJAX Product Filters
• Insecure deserialization

Deserialization of untrusted data in Bosch Rexroth IndraWorks

• Bosch Rexroth IndraWorks
• Insecure deserialization

Deserialization of untrusted data in Bosch Rexroth IndraWorks

• Bosch Rexroth IndraWorks
• Insecure deserialization

Deserialization of untrusted data in Bosch Rexroth IndraWorks and others

• Bosch Rexroth IndraWorks
• Bosch Rexroth UA.Testclient
• Insecure deserialization

Deserialization of untrusted data in Bosch Rexroth IndraWorks

• Bosch Rexroth IndraWorks
• Insecure deserialization

Deserialization of untrusted data in NVIDIA NeMo Framework

• NVIDIA NeMo Framework
• Insecure deserialization

Deserialization of untrusted data in NVIDIA NeMo Framework

• NVIDIA NeMo Framework
• Insecure deserialization

Deserialization of untrusted data in NVIDIA NeMo Framework

• NVIDIA NeMo Framework
• Insecure deserialization

LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE

• ModelTC LightLLM
• Insecure deserialization

JeecgBoot Retrieval-Augmented Generation AiragKnowledgeController.java importDocumentFromZip deserialization

• JeecgBoot
• Insecure deserialization
• CWE-20

Calero VeraSMART < 2022 R1 .NET Remoting Arbitrary File Read Leading to ViewState RCE

• Calero VeraSMART
• Authentication bypass
• Insecure deserialization

ADB Explorer Vulnerable to Remote Code Execution via Insecure Deserialization

• Alex4SSB ADB-Explorer
• Insecure deserialization

Hyland OnBase Timer Service Unauthenticated .NET Remoting RCE

• Hyland OnBase Workflow Timer Service
• Insecure deserialization