cve.bz

CWE-502: Deserialization of Untrusted Data, page 34

Filter

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

What the weakness is: CWE-502 at MITRE

Ask an AI about CWE-502

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-502: Deserialization of Untrusted Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/502.html and https://cve.bz/cve/cwe/502?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.9CVE-2025-30761EPSS 5.2%

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Ed…

  2. 8.8CVE-2025-7504EPSS 0.8%

    The Friends plugin for WordPress is vulnerable to PHP Object Injection in version 3.5.1 via deserialization of untrusted input of the query_vars parameter This makes it possible for authenticated attackers, with subscriber-level access and…

  3. 4.8CVE-2025-30025EPSS 0.2%

    The communication protocol used between the server process and the service control had a flaw that could lead to a local privilege escalation.

  4. 9.0CVE-2025-30023EPSS 0.6%

    The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execution attack.

  5. 7.5CVE-2025-6742EPSS 0.6%

    The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.3 via the use of file_exists() in the delete_entry_files() function without restr…

  6. 5.5CVE-2025-7216EPSS 0.5%

    A vulnerability, which was classified as critical, was found in lty628 Aidigu up to 1.8.2. This affects the function checkUserCookie of the file /application/common.php of the component PHP Object Handler. The manipulation of the argument …

  7. 9.8CVE-2025-49533ExploitEPSS 52%

    Adobe Experience Manager (MS) versions 6.5.23.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an attacker. Exploitation of this issue does not require user inte…

  8. 9.6CVE-2025-27203EPSS 1.2%

    Adobe Connect versions 24.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an attacker. Exploitation of this issue does require user interaction and scope is cha…

  9. 8.6CVE-2025-47994EPSS 3.3%

    Deserialization of untrusted data in Microsoft Office allows an unauthorized attacker to elevate privileges locally.

  10. 9.1CVE-2025-42980EPSS 0.8%

    SAP NetWeaver Enterprise Portal Federated Portal Network is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and ava…

  11. 9.1CVE-2025-42966EPSS 0.7%

    SAP NetWeaver XML Data Archiving Service allows an authenticated attacker with administrative privileges to exploit an insecure Java deserialization vulnerability by sending a specially crafted serialized Java object. This could lead to hi…

  12. 9.1CVE-2025-42964EPSS 0.7%

    SAP NetWeaver Enterprise Portal Administration is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability …

  13. 9.1CVE-2025-42963EPSS 0.7%

    A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator users to exploit unsafe Java object deserialization. Successful exploitation can lead to full operating system compromise,…

  14. 9.8CVE-2025-6811EPSS 0.9%

    Mescius ActiveReports.NET TypeResolutionService Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mescius ActiveReports.…

  15. 9.8CVE-2025-6810EPSS 0.9%

    Mescius ActiveReports.NET ReadValue Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mescius ActiveReports.NET. Interac…

  16. 2.9CVE-2025-7099EPSS 0.5%

    A vulnerability has been found in BoyunCMS up to 1.21 on PHP7 and classified as critical. Affected by this vulnerability is an unknown functionality of the file install/install2.php of the component Installation Handler. The manipulation o…

  17. 8.8CVE-2025-52828EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in designthemes Red Art redart allows Object Injection.This issue affects Red Art: from n/a through <= 3.8.

  18. 9.8CVE-2025-49417EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in BestWpDeveloper WooCommerce Product Multi-Action Woo-product-multiaction allows Object Injection.This issue affects WooCommerce Product Multi-Action: from n/a through <= 1.3.

  19. 6.5CVE-2025-43713EPSS 0.5%

    ASNA Assist and ASNA Registrar before 2025-03-31 allow deserialization attacks against .NET remoting. These are Windows system services that support license key management and deprecated Windows network authentication. The services are imp…

  20. 10.0CVE-2025-34067EPSS 22%

    An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Platform due to the use of a vulnerable version of the Fastjson library. The endpoint /bic/ssoService…

  21. 9.8CVE-2024-13786EPSS 0.6%

    The education theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.10 via deserialization of untrusted input in the 'themerex_callback_view_more_posts' function. This makes it possible for una…

  22. 8.8CVE-2025-6464EPSS 0.6%

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.44.2 via deserialization of untrusted input in the 'entry_delete_upl…

  23. 10.0CVE-2025-34060EPSS 0.8%

    A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image/ endpoint. The application passes a user-supplied link parameter directly to fi…

  24. 7.8CVE-2025-53416EPSS 0.3%

    Delta Electronics DTN Soft Project File Parsing Deserialization of Untrusted Data Remote Code Execution

  25. 7.8CVE-2025-53415EPSS 0.2%

    Delta Electronics DTM Soft Project File Parsing Deserialization of Untrusted Data Remote Code Execution

  26. 6.0CVE-2025-53393EPSS 0.2%

    In Akka through 2.10.6, akka-cluster-metrics uses Java serialization for cluster metrics.

  27. 9.8CVE-2025-32897EPSS 2.0%

    Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This security vulnerability is the same as CVE-2024-47552, but the version range described in the CVE-2024-47552 definition is too narrow. This issue affects Ap…

  28. 8.8CVE-2025-52827EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in uxper Nuss nuss allows Object Injection.This issue affects Nuss: from n/a through <= 1.3.3.

  29. 8.8CVE-2025-52826EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in uxper Sala allows Object Injection. This issue affects Sala: from n/a through 1.1.3.

  30. 9.8CVE-2025-52725EPSS 0.5%

    Deserialization of Untrusted Data vulnerability in pebas CouponXxL couponxxl allows Object Injection.This issue affects CouponXxL: from n/a through <= 3.0.0.

  31. 9.8CVE-2025-52724EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in BoldThemes Amwerk amwerk allows Object Injection.This issue affects Amwerk: from n/a through <= 1.2.0.

  32. 9.8CVE-2025-28970EPSS 0.5%

    Deserialization of Untrusted Data vulnerability in pep.vn WP Optimize By xTraffic wp-optimize-by-xtraffic allows Object Injection.This issue affects WP Optimize By xTraffic: from n/a through <= 5.1.6.

  33. 9.8CVE-2025-53002EPSS 1.3%

    LLaMA-Factory is a tuning library for large language models. A remote code execution vulnerability was discovered in LLaMA-Factory versions up to and including 0.9.3 during the LLaMA-Factory training process. This vulnerability arises beca…

  34. 9.8CVE-2025-36038EPSS 13%

    IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects.

  35. 9.3CVE-2025-2566EPSS 0.6%

    Kaleris NAVIS N4 ULC (Ultra Light Client) contains an unsafe Java deserialization vulnerability. An unauthenticated attacker can make specially crafted requests to execute arbitrary code on the server.

  36. 9.3CVE-2025-25034ExploitEPSS 5.0%

    A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to s…

  37. 8.1CVE-2025-47771EPSS 0.5%

    PowSyBl (Power System Blocks) is a framework to build power system oriented software. In versions 6.3.0 to 6.7.1, there is a deserialization issue in the read method of the SparseMatrix class that can lead to a wide range of privilege esca…

  38. 2.0CVE-2025-6279EPSS 0.5%

    A vulnerability, which was classified as critical, has been found in Upsonic up to 0.55.6. This issue affects the function cloudpickle.loads of the file /tools/add_tool of the component Pickle Handler. The manipulation leads to deserializa…

  39. 9.8CVE-2025-49217EPSS 1.1%

    An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49213 but is …

  40. 8.8CVE-2025-49214EPSS 0.9%

    An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code execution on affected installations. Please note: an attacker must first obtain the ability to exe…

  41. 9.8CVE-2025-49213EPSS 13%

    An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49212 but is …

  42. 9.8CVE-2025-49212EPSS 13%

    An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is …

  43. 9.8CVE-2025-49220EPSS 2.1%

    An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49219 but is i…

  44. 9.8CVE-2025-49219EPSS 1.4%

    An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is …

  45. 7.2CVE-2025-49331EPSS 0.5%

    Deserialization of Untrusted Data vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Object Injection.This issue affects eCommerce Product Catalog: from n/a through <= 3.4.3.

  46. 9.8CVE-2025-49330EPSS 0.6%

    Deserialization of Untrusted Data vulnerability in CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin cf7-zoho allows Object Injection.This issue affects Integration for Contact Form 7 and Zoho CRM, Bigin: from n/a through <= 1.3…

  47. 9.8CVE-2025-31919EPSS 0.5%

    Deserialization of Untrusted Data vulnerability in themeton Spare allows Object Injection. This issue affects Spare: from n/a through 1.7.

  48. 9.8CVE-2025-30618EPSS 0.5%

    Deserialization of Untrusted Data vulnerability in yuliaz Rapyd Payment Extension for WooCommerce rapyd-payments allows Object Injection.This issue affects Rapyd Payment Extension for WooCommerce: from n/a through <= 1.2.0.

  49. 8.1CVE-2025-24919EPSS 2.6%

    A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell ControlVault3 prior to 5.15.10.14 and ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault response to a command ca…

  50. 8.8CVE-2025-47166ExploitEPSS 22%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.