cve.bz

CWE-502: Deserialization of Untrusted Data, page 5

Filter

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

What the weakness is: CWE-502 at MITRE

Ask an AI about CWE-502

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-502: Deserialization of Untrusted Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/502.html and https://cve.bz/cve/cwe/502?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2026-62123EPSS 0.3%

    Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.

  2. 9.8CVE-2026-62120EPSS 0.3%

    Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.

  3. 9.8CVE-2026-62090EPSS 0.4%

    Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.

  4. 9.8CVE-2026-62087EPSS 0.4%

    Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.

  5. 9.8CVE-2026-62086EPSS 0.4%

    Unauthenticated PHP Object Injection in Juno <= 2.25 versions.

  6. 9.8CVE-2026-62077EPSS 0.4%

    Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.

  7. 9.8CVE-2026-62076EPSS 0.4%

    Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.

  8. 9.8CVE-2026-62054EPSS 0.4%

    Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.

  9. 9.8CVE-2026-62053EPSS 0.4%

    Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.

  10. 9.8CVE-2026-62052EPSS 0.4%

    Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.

  11. 9.8CVE-2026-62051EPSS 0.4%

    Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.

  12. 9.8CVE-2026-62050EPSS 0.4%

    Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.

  13. 8.8CVE-2026-62021EPSS 0.5%

    Subscriber PHP Object Injection in Angio <= 1.1.1 versions.

  14. 9.8CVE-2026-42723EPSS 0.4%

    Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.

  15. 9.8CVE-2026-42719EPSS 0.5%

    Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.

  16. 9.8CVE-2026-42718EPSS 0.4%

    Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.

  17. 9.8CVE-2026-42716EPSS 0.4%

    Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.

  18. 7.2CVE-2026-62044EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13.

  19. 9.8CVE-2026-104398EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a throu…

  20. 7.2CVE-2026-94676EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Object Injection.This issue affects Tainacan: from n/a through 1.3.0.

  21. 8.8CVE-2026-105885EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.

  22. 9.8CVE-2026-93945EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.

  23. 9.8CVE-2026-93944EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.

  24. 9.8CVE-2026-93943EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.

  25. 9.8CVE-2026-93942EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.

  26. 9.8CVE-2026-93941EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.

  27. 9.8CVE-2026-93940EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.

  28. 9.8CVE-2026-93938EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.

  29. 9.8CVE-2026-93937EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.

  30. 9.8CVE-2026-93936EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.

  31. 9.8CVE-2026-93935EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.

  32. 9.8CVE-2026-93934EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13.

  33. 9.8CVE-2026-93933EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4.

  34. 9.8CVE-2026-93932EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12.

  35. 9.8CVE-2026-93931EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.

  36. 9.8CVE-2026-93930EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.

  37. 9.8CVE-2026-93929EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16.

  38. 9.8CVE-2026-93927EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0.

  39. 9.8CVE-2026-62046EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.

  40. 9.8CVE-2026-62045EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.

  41. 7.2CVE-2026-106606EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue affects YITH WooCommerce Affiliates: from n/a through 3.31.0.

  42. 7.2CVE-2026-12626EPSS 0.3%

    The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 28.2 via deserialization of untrusted input via the ‘value’ parameter. This make…

  43. 8.8CVE-2026-104723EPSS 0.4%

    The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for aut…

  44. 8.2CVE-2026-102554EPSS 0.4%

    Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactH…

  45. 8.8CVE-2026-94065EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Injection.This issue affects ColorFolio: from n/a through 1.3.

  46. 8.8CVE-2026-94064EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop WordPress Theme: from n/a through 3.5.

  47. 9.3CVE-2026-100730EPSS 0.6%

    A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows A…

  48. 7.2CVE-2026-105872EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5.

  49. 8.8CVE-2026-104392EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.

  50. 7.2CVE-2026-94568EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-vipps allows Object Injection.This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.0.