cve.bz

CWE-502: Deserialization of Untrusted Data, page 9

Filter

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

What the weakness is: CWE-502 at MITRE

Ask an AI about CWE-502

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-502: Deserialization of Untrusted Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/502.html and https://cve.bz/cve/cwe/502?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 2.9CVE-2026-90575EPSS 0.5%

    A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the component Login Success Handler. This manipulation of the argument geopluginURL causes deserialization. It …

  2. 8.7CVE-2026-90777EPSS 0.7%

    ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code durin…

  3. 2.1CVE-2026-90490EPSS 0.4%

    A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This issue affects some unknown processing of the component MailReceiver. Performing a manipulation results in deserialization. The attack is possible to be carried out remotel…

  4. 8.8CVE-2026-78175EPSS 1.1%

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX…

  5. 9.8CVE-2026-78006EPSS 1.5%

    The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, w…

  6. 8.1CVE-2026-84099EPSS 0.5%

    The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to injec…

  7. 9.9CVE-2026-82845EPSS 0.6%

    The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a…

  8. 9.9CVE-2026-87719EPSS 0.6%

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated use…

  9. 8.8CVE-2026-62107EPSS 0.5%

    Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions.

  10. 9.8CVE-2026-62105EPSS 0.6%

    Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.

  11. 9.8CVE-2026-62103EPSS 0.6%

    Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.

  12. 8.6CVE-2026-73699EPSS 0.8%

    FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize() in the Perms::getPerms() method, where a positional…

  13. 8.1CVE-2026-81784EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in Marcin Wise Chat wise-chat allows Object Injection.This issue affects Wise Chat: from n/a through 3.4.2.

  14. 8.1CVE-2026-82925EPSS 0.5%

    The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on instal…

  15. 6.5CVE-2026-57822EPSS 0.7%

    When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform management-via-messaging, the parameter processing can trigger Java deserializa…

  16. 9.2CVE-2026-87930EPSS 0.6%

    MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to t…

  17. 8.1CVE-2026-87874EPSS 0.7%

    A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records are stored in JSON format, the plugin performs no explicit serialization and relies on python-memcac…

  18. 8.7CVE-2024-58381EPSS 0.8%

    PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization fro…

  19. 6.6CVE-2026-11363EPSS 0.9%

    The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for auth…

  20. 5.1CVE-2026-87083EPSS 0.3%

    A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function KernelCache._load_kernel_from_disk of the file tilelang/cache/kernel_cache.py of the component Kernel Cache. Executing a manipulation can lead to de…

  21. 8.8CVE-2026-81385EPSS 1.3%

    Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network.

  22. 8.8CVE-2026-77484EPSS 1.7%

    Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.

  23. 7.0CVE-2026-69694EPSS 2.8%

    Deserialization of untrusted data in Windows IP Address Management (IPAM) Service allows an authorized attacker to elevate privileges locally.

  24. 8.8CVE-2026-65772EPSS 1.7%

    Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.

  25. 8.1CVE-2026-47297EPSS 1.1%

    Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.

  26. 9.8CVE-2026-12745EPSS 2.9%

    A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.

  27. 9.8CVE-2026-12744EPSS 2.9%

    A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.

  28. 8.8CVE-2026-12651EPSS 1.9%

    A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

  29. 8.8CVE-2026-12650EPSS 1.9%

    A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

  30. 8.8CVE-2026-12648EPSS 1.9%

    A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

  31. 7.3CVE-2026-77092EPSS 0.3%

    Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor.

  32. 8.8CVE-2026-16502EPSS 0.9%

    The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated at…

  33. 9.8CVE-2026-71374EPSS 0.6%

    Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 throu…

  34. 7.8CVE-2026-76967EPSS 0.4%

    SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted…

  35. 9.8CVE-2026-7861EPSS 0.6%

    Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Code Injection. This issue affects CSM (Customer Service Management): before 8.0.3.

  36. 8.8CVE-2026-86404EPSS 0.7%

    EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() metho…

  37. 9.8CVE-2026-10196EPSS 1.1%

    The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handl…

  38. 8.8CVE-2026-19887EPSS 1.1%

    The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback (usces_action_acting_transaction). Un…

  39. 9.4CVE-2026-52777EPSS 0.3%

    YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6.

  40. 7.5CVE-2026-61686EPSS 0.4%

    SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the `DataGrid` LiveComponent deserializes a `context` prop value using PHP's `unserialize()` after receiving it from the client. Because the prop is marked `writabl…

  41. 6.2CVE-2026-19795EPSS 0.3%

    Qiskit could allow a local attacker to cause a denial of service due to a stack overflow during deserialization of QPY payloads. A malicious QPY payload can trigger a segmentation fault, causing the application to crash when deserializing …

  42. 9.8CVE-2026-84834EPSS 0.6%

    Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions.

  43. 9.8CVE-2026-84753EPSS 0.6%

    Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.

  44. 8.8CVE-2026-84752EPSS 0.5%

    Contributor PHP Object Injection in RTMKit <= 2.1.5 versions.

  45. 8.6CVE-2026-84832EPSS 0.6%

    SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker with a privileged API token can execute arbitrary commands with "nobody" privil…

  46. 8.8CVE-2026-84670EPSS 0.6%

    Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers wi…

  47. 8.8CVE-2026-84650EPSS 0.5%

    In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, t…

  48. 8.8CVE-2026-84647EPSS 0.5%

    In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to t…

  49. 4.3CVE-2026-84646EPSS 0.5%

    In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML.

  50. 3.3CVE-2023-3360EPSS 0.2%

    The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on…