cve.bz

CWE-502: Deserialization of Untrusted Data

Filter

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

What the weakness is: CWE-502 at MITRE

Ask an AI about CWE-502

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-502: Deserialization of Untrusted Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/502.html and https://cve.bz/cve/cwe/502?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 2.0CVE-2026-120320

    A vulnerability was determined in jxxghp MoviePilot up to 3.1.2. This vulnerability affects the function WorkflowExecutor.restore_context of the file app/chain/workflow.py of the component Workflow Fork Endpoint. Executing a manipulation c…

  2. 9.8CVE-2026-118636EPSS 0.6%Unsupported when assigned

    JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch …

  3. 9.8CVE-2026-109220EPSS 0.5%

    The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This is due to insufficien…

  4. 8.7CVE-2026-63393EPSS 0.5%

    OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can pr…

  5. 8.8CVE-2026-16760EPSS 0.5%

    In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in sys.stdlib_module_names and the name is absent from the UNSAF…

  6. 8.8CVE-2026-118938EPSS 0.5%

    In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Values.read_file") is resolved by pickle's find_class through _getattribute to an arbitrary attribute path rather than to …

  7. 7.3CVE-2026-62848EPSS 0.2%

    Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. From 2023.0.101-rc until 2025.1.18, 2026.0.25 and 2026.1.19, the Windows Visual Studio integration deserializes local named-pipe messages without restricting …

  8. 9.8CVE-2026-90888EPSS 0.3%

    Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.

  9. 8.8CVE-2026-78527EPSS 0.4%

    Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.

  10. 8.8CVE-2026-73186EPSS 0.4%

    Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.

  11. 9.8CVE-2026-39738EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Injection.This issue affects FunnelKit Automations: from n/a through 3.8.6.1.

  12. 9.8CVE-2026-119526EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.

  13. 8.8CVE-2026-118090EPSS 0.4%

    Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.

  14. 7.2CVE-2026-118089EPSS 0.4%

    Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.

  15. 5.3CVE-2026-61803EPSS 0.2%

    Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, the `course/certificate checkout` flow accepts client-controlled pricing, allowing an authenticated user to com…

  16. 9.3CVE-2026-119706EPSS 1.0%

    InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-e…

  17. 9.4CVE-2026-93327EPSS 0.4%

    A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a mali…

  18. 7.5CVE-2026-45145EPSS 0.4%

    Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `public/main/cron/import_csv.php` call PHP's native `unserialize()` on `user_career.extra_data` retrieved from the database …

  19. 9.8CVE-2026-103039EPSS 0.5%

    The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted val…

  20. 7.5CVE-2026-114422EPSS 0.5%

    The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that i…

  21. –CVE-2026-118562EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.

  22. 8.7CVE-2026-107238EPSS 0.4%

    A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.

  23. 9.3CVE-2023-22793EPSS 0.5%

    A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.

  24. 9.8CVE-2026-62131EPSS 0.3%

    Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.

  25. 9.8CVE-2026-62018EPSS 0.4%

    Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.

  26. 9.8CVE-2026-62017EPSS 0.4%

    Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

  27. 9.8CVE-2026-62016EPSS 0.4%

    Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.

  28. 9.8CVE-2026-62015EPSS 0.4%

    Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.

  29. 9.8CVE-2026-62014EPSS 0.4%

    Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.

  30. 9.8CVE-2026-62013EPSS 0.4%

    Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.

  31. 9.8CVE-2026-62012EPSS 0.4%

    Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.

  32. 9.8CVE-2026-62011EPSS 0.4%

    Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.

  33. 9.8CVE-2026-62010EPSS 0.4%

    Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.

  34. 9.8CVE-2026-62009EPSS 0.4%

    Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.

  35. 9.8CVE-2026-62008EPSS 0.4%

    Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

  36. 9.8CVE-2026-62006EPSS 0.4%

    Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.

  37. 9.8CVE-2026-62005EPSS 0.4%

    Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.

  38. 9.8CVE-2026-62004EPSS 0.4%

    Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.

  39. 9.8CVE-2026-62003EPSS 0.4%

    Unauthenticated PHP Object Injection in Mission <= 1.22 versions.

  40. 9.8CVE-2026-62002EPSS 0.5%

    Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.

  41. 9.8CVE-2026-62001EPSS 0.5%

    Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.

  42. 9.8CVE-2026-61998EPSS 0.5%

    Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.

  43. 9.8CVE-2026-61997EPSS 0.5%

    Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.

  44. 9.8CVE-2026-61992EPSS 0.4%

    Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.

  45. 9.8CVE-2026-54860EPSS 0.5%

    Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.

  46. 9.8CVE-2026-54859EPSS 0.5%

    Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.

  47. 9.8CVE-2026-54858EPSS 0.5%

    Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.

  48. 9.8CVE-2026-54857EPSS 0.5%

    Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.

  49. 9.8CVE-2026-54856EPSS 0.5%

    Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.

  50. 7.2CVE-2026-42701EPSS 0.4%

    Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.