CWE-502

Deserialization of Untrusted Data

BaseDraftLikelihood: Medium

Description

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Hierarchy (View 1000)

Parents

CWE-913

Children

none

Related attack patterns (CAPEC)

CAPEC-586

CVEs mapped to this weakness (1,721)

page 15 of 87

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2024-49222	AmentoTech WPGuppy	Cri	0.64	9.8	0.00	Jan 7, 2025	Deserialization of Untrusted Data vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Object Injection.This issue affects WPGuppy: from n/a through <= 1.1.0.
CVE-2024-54367	Ultimatemember Forumwp	Cri	0.64	9.8	0.01	Dec 16, 2024	Deserialization of Untrusted Data vulnerability in Ultimate Member ForumWP forumwp allows Object Injection.This issue affects ForumWP: from n/a through <= 2.1.0.
CVE-2024-54273	WordPress Mail Picker	Cri	0.64	9.8	0.01	Dec 13, 2024	Deserialization of Untrusted Data vulnerability in PickPlugins Mail Picker mail-picker allows Object Injection.This issue affects Mail Picker: from n/a through <= 1.0.14.
CVE-2024-51363	Hodoku Hodoku	Cri	0.64	9.8	0.01	Dec 3, 2024	Insecure deserialization in Hodoku v2.3.0 to v2.3.2 allows attackers to execute arbitrary code.
CVE-2024-52443	masikonis Geolocator	Cri	0.64	9.8	0.01	Nov 20, 2024	Deserialization of Untrusted Data vulnerability in masikonis Geolocator geolocator allows Object Injection.This issue affects Geolocator: from n/a through <= 1.1.
CVE-2024-52440	xpresslane Xpresslane Fast Checkout	Cri	0.64	9.8	0.01	Nov 20, 2024	Deserialization of Untrusted Data vulnerability in xpresslane Xpresslane Fast Checkout xpresslane-integration-for-woocommerce allows Object Injection.This issue affects Xpresslane Fast Checkout: from n/a through <= 1.0.0.
CVE-2024-52439	Shoalsummitsolutions Team Rosters	Cri	0.64	9.8	0.01	Nov 20, 2024	Deserialization of Untrusted Data vulnerability in Mark O'Donnell Team Rosters team-rosters allows Object Injection.This issue affects Team Rosters: from n/a through <= 4.8.2.
CVE-2024-52432	Nixsolutions Nix Anti Spam Light	Cri	0.64	9.8	0.01	Nov 18, 2024	Deserialization of Untrusted Data vulnerability in NIX Solutions Ltd NIX Anti-Spam Light nix-anti-spam-light allows Object Injection.This issue affects NIX Anti-Spam Light: from n/a through <= 0.0.4.
CVE-2024-52414	WordPress Wdes Responsive Mobile Menu	Cri	0.64	9.8	0.01	Nov 16, 2024	Deserialization of Untrusted Data vulnerability in Anthony Carbon WDES Responsive Mobile Menu wdes-responsive-mobile-menu allows Object Injection.This issue affects WDES Responsive Mobile Menu: from n/a through <= 5.3.18.
CVE-2024-52413	dmcwebzone Airin Blog	Cri	0.64	9.8	0.01	Nov 16, 2024	Deserialization of Untrusted Data vulnerability in dmcwebzone Airin Blog airin-blog allows Object Injection.This issue affects Airin Blog: from n/a through <= 1.6.1.
CVE-2024-52412	WordPress Xin	Cri	0.64	9.8	0.01	Nov 16, 2024	Deserialization of Untrusted Data vulnerability in Stephen Cui Xin allows Object Injection.This issue affects Xin: from n/a through 1.0.8.1.
CVE-2024-52411	flowcraft Advanced Personalization	Cri	0.64	9.8	0.01	Nov 16, 2024	Deserialization of Untrusted Data vulnerability in flowcraft Advanced Personalization personalization-by-flowcraft allows Object Injection.This issue affects Advanced Personalization: from n/a through <= 1.1.2.
CVE-2024-52410	WordPress Referrer Detector	Cri	0.64	9.8	0.01	Nov 16, 2024	Deserialization of Untrusted Data vulnerability in Phoenixheart Referrer Detector referrer-detector allows Object Injection.This issue affects Referrer Detector: from n/a through <= 4.2.1.0.
CVE-2024-52409	WordPress Ajax Random Posts	Cri	0.64	9.8	0.01	Nov 16, 2024	Deserialization of Untrusted Data vulnerability in Phoenixheart AJAX Random Posts ajax-random-posts allows Object Injection.This issue affects AJAX Random Posts: from n/a through <= 0.3.3.
CVE-2024-10456	Delta Electronics InfraSuite Device Master	Cri	0.64	9.8	0.18	Oct 30, 2024	Delta Electronics InfraSuite Device Master versions prior to 1.0.12 are affected by a deserialization vulnerability that targets the Device-Gateway, which could allow deserialization of arbitrary .NET objects prior to authentication.
CVE-2024-48206	Jqhph Chainer	Cri	0.64	9.8	0.01	Oct 29, 2024	A Deserialization of Untrusted Data vulnerability in chainer v7.8.1.post1 leads to execution of arbitrary code.
CVE-2024-49625	Brandonclark Sitebuilder Dynamic Components	Cri	0.64	9.8	0.01	Oct 20, 2024	Deserialization of Untrusted Data vulnerability in sphoid SiteBuilder Dynamic Components sitebuilder-dynamic-components allows Object Injection.This issue affects SiteBuilder Dynamic Components: from n/a through <= 1.0.
CVE-2024-49624	Smartdevth Advanced Advertising System	Cri	0.64	9.8	0.01	Oct 20, 2024	Deserialization of Untrusted Data vulnerability in smartdevth Advanced Advertising System advanced-advertising-system allows Object Injection.This issue affects Advanced Advertising System: from n/a through <= 1.3.1.
CVE-2024-49332	Giveawayboost Giveaway Boost	Cri	0.64	9.8	0.01	Oct 20, 2024	Deserialization of Untrusted Data vulnerability in giveawayboost Giveaway Boost giveaway-boost allows Object Injection.This issue affects Giveaway Boost: from n/a through <= 2.1.4.
CVE-2024-49626	Piyushmca Shipyaari Shipping Management	Cri	0.64	9.8	0.01	Oct 20, 2024	Deserialization of Untrusted Data vulnerability in Piyush Patel Shipyaari Shipping Management shipyaari-shipping-managment allows Object Injection.This issue affects Shipyaari Shipping Management: from n/a through <= 1.2.

CVE-2024-49222CriJan 7, 2025
AmentoTech
WPGuppy
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Object Injection.This issue affects WPGuppy: from n/a through <= 1.1.0.
CVE-2024-54367CriDec 16, 2024
Ultimatemember
Forumwp
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in Ultimate Member ForumWP forumwp allows Object Injection.This issue affects ForumWP: from n/a through <= 2.1.0.
CVE-2024-54273CriDec 13, 2024
WordPress
Mail Picker
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in PickPlugins Mail Picker mail-picker allows Object Injection.This issue affects Mail Picker: from n/a through <= 1.0.14.
CVE-2024-51363CriDec 3, 2024
Hodoku
Hodoku
risk 0.64cvss 9.8epss 0.01
Insecure deserialization in Hodoku v2.3.0 to v2.3.2 allows attackers to execute arbitrary code.
CVE-2024-52443CriNov 20, 2024
masikonis
Geolocator
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in masikonis Geolocator geolocator allows Object Injection.This issue affects Geolocator: from n/a through <= 1.1.
CVE-2024-52440CriNov 20, 2024
xpresslane
Xpresslane Fast Checkout
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in xpresslane Xpresslane Fast Checkout xpresslane-integration-for-woocommerce allows Object Injection.This issue affects Xpresslane Fast Checkout: from n/a through <= 1.0.0.
CVE-2024-52439CriNov 20, 2024
Shoalsummitsolutions
Team Rosters
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in Mark O'Donnell Team Rosters team-rosters allows Object Injection.This issue affects Team Rosters: from n/a through <= 4.8.2.
CVE-2024-52432CriNov 18, 2024
Nixsolutions
Nix Anti Spam Light
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in NIX Solutions Ltd NIX Anti-Spam Light nix-anti-spam-light allows Object Injection.This issue affects NIX Anti-Spam Light: from n/a through <= 0.0.4.
CVE-2024-52414CriNov 16, 2024
WordPress
Wdes Responsive Mobile Menu
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in Anthony Carbon WDES Responsive Mobile Menu wdes-responsive-mobile-menu allows Object Injection.This issue affects WDES Responsive Mobile Menu: from n/a through <= 5.3.18.
CVE-2024-52413CriNov 16, 2024
dmcwebzone
Airin Blog
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in dmcwebzone Airin Blog airin-blog allows Object Injection.This issue affects Airin Blog: from n/a through <= 1.6.1.
CVE-2024-52412CriNov 16, 2024
WordPress
Xin
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in Stephen Cui Xin allows Object Injection.This issue affects Xin: from n/a through 1.0.8.1.
CVE-2024-52411CriNov 16, 2024
flowcraft
Advanced Personalization
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in flowcraft Advanced Personalization personalization-by-flowcraft allows Object Injection.This issue affects Advanced Personalization: from n/a through <= 1.1.2.
CVE-2024-52410CriNov 16, 2024
WordPress
Referrer Detector
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in Phoenixheart Referrer Detector referrer-detector allows Object Injection.This issue affects Referrer Detector: from n/a through <= 4.2.1.0.
CVE-2024-52409CriNov 16, 2024
WordPress
Ajax Random Posts
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in Phoenixheart AJAX Random Posts ajax-random-posts allows Object Injection.This issue affects AJAX Random Posts: from n/a through <= 0.3.3.
CVE-2024-10456CriOct 30, 2024
Delta Electronics
InfraSuite Device Master
risk 0.64cvss 9.8epss 0.18
Delta Electronics InfraSuite Device Master versions prior to 1.0.12 are affected by a deserialization vulnerability that targets the Device-Gateway, which could allow deserialization of arbitrary .NET objects prior to authentication.
CVE-2024-48206CriOct 29, 2024
Jqhph
Chainer
risk 0.64cvss 9.8epss 0.01
A Deserialization of Untrusted Data vulnerability in chainer v7.8.1.post1 leads to execution of arbitrary code.
CVE-2024-49625CriOct 20, 2024
Brandonclark
Sitebuilder Dynamic Components
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in sphoid SiteBuilder Dynamic Components sitebuilder-dynamic-components allows Object Injection.This issue affects SiteBuilder Dynamic Components: from n/a through <= 1.0.
CVE-2024-49624CriOct 20, 2024
Smartdevth
Advanced Advertising System
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in smartdevth Advanced Advertising System advanced-advertising-system allows Object Injection.This issue affects Advanced Advertising System: from n/a through <= 1.3.1.
CVE-2024-49332CriOct 20, 2024
Giveawayboost
Giveaway Boost
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in giveawayboost Giveaway Boost giveaway-boost allows Object Injection.This issue affects Giveaway Boost: from n/a through <= 2.1.4.
CVE-2024-49626CriOct 20, 2024
Piyushmca
Shipyaari Shipping Management
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in Piyush Patel Shipyaari Shipping Management shipyaari-shipping-managment allows Object Injection.This issue affects Shipyaari Shipping Management: from n/a through <= 1.2.