Insecure deserialization.

SuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter Processing

• SuiteCRM-Core
• Insecure deserialization

BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE

• BMC Software, Inc. FootPrints
• Insecure deserialization

WordPress WishList Member X plugin <= 3.29.0 - PHP Object Injection vulnerability

• Membership Software WishList Member X
• Insecure deserialization

WordPress Finag theme <= 1.5.0 - PHP Object Injection vulnerability

• Themeton Finag
• Insecure deserialization

WordPress Zuut theme <= 1.4.2 - PHP Object Injection vulnerability

• Themeton Zuut
• Insecure deserialization

WordPress ColorFolio - Freelance Designer WordPress Theme theme <= 1.3 - Deserialization of untrusted data vulnerability

• BuddhaThemes ColorFolio - Freelance Designer WordPress Theme
• Insecure deserialization

OmniGen2-RL Reward Server Unsafe Deserialization RCE

• Beijing Academy of Artificial Intelligence (BAAI) OmniGen2-RL
• Insecure deserialization

The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class

• Insecure deserialization

<0.4.5 || >=0.5.0, <0.5.2 · fixed in 0.4.5, 0.5.2

WordPress Traveler theme < 3.2.8.1 - PHP Object Injection vulnerability

• shinetheme Traveler
• Insecure deserialization

Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization

• wazuh
• Insecure deserialization

Apache Spark: Spark History Server Code Execution Vulnerability

• Insecure deserialization

<=2.2.3 · no fixed version yet

WordPress JetEngine plugin < 3.8.4.1 - Deserialization of untrusted data vulnerability

• Crocoblock JetEngine
• Insecure deserialization

Inductive Automation Ignition Software Deserialization of Untrusted Data

• Inductive Automation Ignition Software
• Insecure deserialization

SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization

• Insecure deserialization

<0.5.10 · fixed in 0.5.10

Alfresco Activiti Process Variable Serialization System SerializableType.java createObjectInputStream deserialization

• Alfresco Activiti
• Insecure deserialization
• CWE-20

GLPI affected by Remote Code Execution via malicious upload

• glpi
• Insecure deserialization

Divi Booster < 5.0.2 - Unauthenticated PHP Object Injection

• divi-booster
• Cross-site request forgery (CSRF)
• Insecure deserialization

Deserialization of untrusted data in Schneider Electric EcoStruxure™ Foxboro DCS

• Schneider Electric EcoStruxure™ Foxboro DCS
• Insecure deserialization

Microsoft SharePoint Server Remote Code Execution Vulnerability

• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Server 2019
• Insecure deserialization

Windows System Image Manager Assessment and Deployment Kit (ADK) Remote Code Execution Vulnerability

• Microsoft Windows ADK for Windows 10, version 2004
• Microsoft Windows ADK for Windows 11, version 22H2
• Insecure deserialization

Deserialization of untrusted data in Schneider Electric EcoStruxure™ Power Monitoring Expert (PME) and others

• Schneider Electric EcoStruxure™ Power Monitoring Expert (PME)
• Schneider Electric EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module
• Insecure deserialization

Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration

• SAP_SE SAP NetWeaver Enterprise Portal Administration
• Insecure deserialization

A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server.

• Insecure deserialization

JS Archive List <= 6.1.7 - Authenticated (Contributor+) PHP Object Injection via 'included' Shortcode Attribute

• skatox JS Archive List
• Insecure deserialization

LangGraph checkpoint loading has unsafe msgpack deserialization

• Insecure deserialization

<1.0.10 · fixed in 1.0.10

Avira Internet Security System Speedup Insecure Deserialization

• Gen Digital Inc. Avira Internet Security
• Insecure deserialization

Database for Contact Form 7, WPforms, Elementor forms <= 1.4.7 - Unauthenticated PHP Object Injection via 'download_csv'

• crmperks Database for Contact Form 7, WPforms, Elementor forms
• Insecure deserialization

WordPress Good Energy theme <= 1.7.7 - PHP Object Injection vulnerability

• ThemeREX Good Energy
• Insecure deserialization

WordPress Pizza House theme <= 1.4.0 - PHP Object Injection vulnerability

• ThemeREX Pizza House
• Insecure deserialization

WordPress Dentario theme <= 1.5 - PHP Object Injection vulnerability

• ThemeREX Dentario
• Insecure deserialization

WordPress Kingler theme <= 1.7 - PHP Object Injection vulnerability

• ThemeREX Kingler
• Insecure deserialization

WordPress Tennis Club theme <= 1.2.3 - PHP Object Injection vulnerability

• ThemeREX Tennis Club
• Insecure deserialization

WordPress Sweet Date theme < 4.0.1 - PHP Object Injection vulnerability

• SeventhQueen Sweet Date
• Insecure deserialization

WordPress NextScripts plugin <= 4.4.7 - PHP Object Injection vulnerability

• NextScripts
• Insecure deserialization

WordPress Celeste theme <= 1.3.6 - PHP Object Injection vulnerability

• BoldThemes Celeste
• Insecure deserialization

WordPress Car Zone theme <= 3.7 - Deserialization of untrusted data vulnerability

• AivahThemes Car Zone
• Insecure deserialization

WordPress Au Pair Agency - Babysitting & Nanny Theme theme <= 1.2.2 - Deserialization of untrusted data vulnerability

• axiomthemes Au Pair Agency - Babysitting & Nanny Theme
• Insecure deserialization

WordPress Podlove Web Player plugin <= 5.9.1 - PHP Object Injection vulnerability

• gerritvanaaken Podlove Web Player
• Insecure deserialization

WordPress PowerPress Podcasting plugin <= 11.15.10 - PHP Object Injection vulnerability

• blubrry PowerPress Podcasting
• Insecure deserialization

WordPress Mounthood theme <= 1.3.2 - PHP Object Injection vulnerability

• axiomthemes Mounthood
• Insecure deserialization

WordPress Jardi theme <= 1.7.2 - PHP Object Injection vulnerability

• AncoraThemes Jardi
• Insecure deserialization

WordPress Estate theme <= 1.3.4 - PHP Object Injection vulnerability

• axiomthemes Estate
• Insecure deserialization

WordPress Equestrian Centre theme <= 1.5 - PHP Object Injection vulnerability

• ThemeREX Equestrian Centre
• Insecure deserialization

WordPress Dental Clinic theme <= 3.7 - PHP Object Injection vulnerability

• designthemes Dental Clinic
• Insecure deserialization

WordPress Secudeal Payments for Ecommerce plugin <= 1.1 - PHP Object Injection vulnerability

• maximsecudeal Secudeal Payments for Ecommerce
• Insecure deserialization

WordPress Solaris theme <= 2.5 - PHP Object Injection vulnerability

• ThemeREX Solaris
• Insecure deserialization

WordPress Pets Club theme <= 2.3 - PHP Object Injection vulnerability

• ThemeREX Pets Club
• Insecure deserialization

WordPress Handyman theme <= 1.4.7 - PHP Object Injection vulnerability

• AncoraThemes Handyman
• Insecure deserialization

WordPress Grand Wedding theme < 3.1.11 - PHP Object Injection vulnerability

• ThemeGoods Grand Wedding
• Insecure deserialization

WordPress Classter theme <= 2.5 - PHP Object Injection vulnerability

• ThemeREX Classter
• Insecure deserialization

Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability

• Cisco Secure Firewall Management Center (FMC)
• Insecure deserialization

Concrete CMS vulnerable to Remote Code Execution by stored PHP object injection

• Insecure deserialization

<9.4.8 · fixed in 9.4.8

An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loads(request.get_data()) component

• Insecure deserialization

Qwik vulnerable to Unauthenticated RCE via server$ Deserialization

• Insecure deserialization

<1.19.1 · fixed in 1.19.1

Chamilo: PHAR deserialization bypass

• chamilo-lms
• Insecure deserialization

Chamilo: Deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parameters

• chamilo-lms
• Insecure deserialization

Chamilo: Post-Auth Remote Code Execution

• chamilo-lms
• Insecure deserialization

e-Excellence｜U-Office Force - Insecure Deserialization

• e-Excellence U-Office Force
• Insecure deserialization

WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field

• smub WP Mail Logging
• Insecure deserialization

Super Stage WP <= 1.0.1 - Unauthenticated PHP Object Injection

• Super Stage WP
• Insecure deserialization