VYPR

CWE-502

Deserialization of Untrusted Data

BaseDraftLikelihood: Medium

Description

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-586

CVEs mapped to this weakness (3,104)

page 18 of 156
  • CVE-2026-27437CriMar 5, 2026
    WordPress
    Tennis Club
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in ThemeREX Tennis Club tennis-sportclub allows Object Injection.This issue affects Tennis Club: from n/a through <= 1.2.3.

  • CVE-2026-27417CriMar 5, 2026
    WordPress
    Sweet Date
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in SeventhQueen Sweet Date sweetdate allows Object Injection.This issue affects Sweet Date: from n/a through < 4.0.1.

  • CVE-2026-22501CriMar 5, 2026
    WordPress
    Mounthood
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in axiomthemes Mounthood mounthood allows Object Injection.This issue affects Mounthood: from n/a through <= 1.3.2.

  • CVE-2026-22497CriMar 5, 2026
    WordPress
    Jardi
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in AncoraThemes Jardi jardi allows Object Injection.This issue affects Jardi: from n/a through <= 1.7.2.

  • CVE-2026-22475CriMar 5, 2026
    WordPress
    Estate
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in axiomthemes Estate estate allows Object Injection.This issue affects Estate: from n/a through <= 1.3.4.

  • CVE-2026-22474CriMar 5, 2026
    Themerex
    Equestrian Centre
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in ThemeREX Equestrian Centre equestrian-centre allows Object Injection.This issue affects Equestrian Centre: from n/a through <= 1.5.

  • CVE-2026-22454CriMar 5, 2026
    WordPress
    Solaris
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in ThemeREX Solaris solaris allows Object Injection.This issue affects Solaris: from n/a through <= 2.5.

  • CVE-2026-22453CriMar 5, 2026
    WordPress
    Pets Club
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in ThemeREX Pets Club petclub allows Object Injection.This issue affects Pets Club: from n/a through <= 2.3.

  • CVE-2026-22451CriMar 5, 2026
    WordPress
    Handyman
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in AncoraThemes Handyman handyman-services allows Object Injection.This issue affects Handyman: from n/a through <= 1.4.7.

  • CVE-2026-22417CriMar 5, 2026
    WordPress
    Grand Wedding
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Wedding grandwedding allows Object Injection.This issue affects Grand Wedding: from n/a through < 3.1.11.

  • CVE-2025-54001CriMar 5, 2026
    WordPress
    Classter
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in ThemeREX Classter classter allows Object Injection.This issue affects Classter: from n/a through <= 2.5.

  • CVE-2025-57622CriMar 3, 2026
    Step-Video-T2V
    Step-Video-T2V
    risk 0.64cvss 9.8epss 0.01

    An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loads(request.get_data()) component

  • CVE-2026-3422CriMar 2, 2026
    Edetw
    U Office Force
    risk 0.64cvss 9.8epss 0.01

    U-Office Force developed by e-Excellence has a Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized content.

  • CVE-2026-26222CriFeb 24, 2026
    Beyond
    Altec Doclink
    risk 0.64cvss 9.8epss 0.01

    Altec DocLink (now maintained by Beyond Limits Inc.) version 4.0.336.0 exposes insecure .NET Remoting endpoints over TCP and HTTP/SOAP via Altec.RDCHostService.exe using the ObjectURI "doclinkServer.soap". The service does not require authentication and is vulnerable to unsafe…

  • CVE-2026-22384CriFeb 20, 2026
    WordPress
    Applay - Shortcodes
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in leafcolor Applay - Shortcodes applay-shortcodes allows Object Injection.This issue affects Applay - Shortcodes: from n/a through <= 3.7.

  • CVE-2025-69405CriFeb 20, 2026
    WordPress
    Lorem Ipsum | Books & Media Store
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in ThemeREX Lorem Ipsum | Books & Media Store lorem-ipsum-books-media-store allows Object Injection.This issue affects Lorem Ipsum | Books & Media Store: from n/a through <= 1.2.11.

  • CVE-2025-69404CriFeb 20, 2026
    WordPress
    Extreme Store
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in ThemeREX Extreme Store extremestore allows Object Injection.This issue affects Extreme Store: from n/a through <= 1.5.10.

  • CVE-2025-69382CriFeb 20, 2026
    WordPress
    Themesflat Elementor
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in themesflat Themesflat Elementor themesflat-elementor allows Object Injection.This issue affects Themesflat Elementor: from n/a through <= 1.0.1.

  • CVE-2025-69372CriFeb 20, 2026
    WordPress
    SevenHills
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in AncoraThemes SevenHills sevenhills allows Object Injection.This issue affects SevenHills: from n/a through <= 1.6.2.

  • CVE-2025-69371CriFeb 20, 2026
    WordPress
    Kindlycare
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in AncoraThemes KindlyCare kindlycare allows Object Injection.This issue affects KindlyCare: from n/a through <= 1.6.1.