VYPR

CWE-502

Deserialization of Untrusted Data

BaseDraftLikelihood: Medium

Description

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-586

CVEs mapped to this weakness (3,308)

page 20 of 166
  • CVE-2026-25449CriMar 18, 2026
    WordPress
    Traveler
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1.

  • CVE-2025-56422CriMar 10, 2026
    Limesurvey
    Limesurvey
    risk 0.64cvss 9.8epss 0.01

    A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server.

  • CVE-2026-28105CriMar 5, 2026
    WordPress
    Good Energy
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in ThemeREX Good Energy goodenergy allows Object Injection.This issue affects Good Energy: from n/a through <= 1.7.7.

  • CVE-2026-28074CriMar 5, 2026
    WordPress
    Pizza House
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in ThemeREX Pizza House pizzahouse allows Object Injection.This issue affects Pizza House: from n/a through <= 1.4.0.

  • CVE-2026-27439CriMar 5, 2026
    WordPress
    Dentario
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in ThemeREX Dentario dentario allows Object Injection.This issue affects Dentario: from n/a through <= 1.5.

  • CVE-2026-27438CriMar 5, 2026
    WordPress
    Kingler
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in ThemeREX Kingler kingler allows Object Injection.This issue affects Kingler: from n/a through <= 1.7.

  • CVE-2026-27437CriMar 5, 2026
    WordPress
    Tennis Club
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in ThemeREX Tennis Club tennis-sportclub allows Object Injection.This issue affects Tennis Club: from n/a through <= 1.2.3.

  • CVE-2026-27417CriMar 5, 2026
    WordPress
    Sweet Date
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in SeventhQueen Sweet Date sweetdate allows Object Injection.This issue affects Sweet Date: from n/a through < 4.0.1.

  • CVE-2026-22501CriMar 5, 2026
    WordPress
    Mounthood
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in axiomthemes Mounthood mounthood allows Object Injection.This issue affects Mounthood: from n/a through <= 1.3.2.

  • CVE-2026-22497CriMar 5, 2026
    WordPress
    Jardi
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in AncoraThemes Jardi jardi allows Object Injection.This issue affects Jardi: from n/a through <= 1.7.2.

  • CVE-2026-22475CriMar 5, 2026
    WordPress
    Estate
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in axiomthemes Estate estate allows Object Injection.This issue affects Estate: from n/a through <= 1.3.4.

  • CVE-2026-22474CriMar 5, 2026
    Themerex
    Equestrian Centre
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in ThemeREX Equestrian Centre equestrian-centre allows Object Injection.This issue affects Equestrian Centre: from n/a through <= 1.5.

  • CVE-2026-22454CriMar 5, 2026
    WordPress
    Solaris
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in ThemeREX Solaris solaris allows Object Injection.This issue affects Solaris: from n/a through <= 2.5.

  • CVE-2026-22453CriMar 5, 2026
    WordPress
    Pets Club
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in ThemeREX Pets Club petclub allows Object Injection.This issue affects Pets Club: from n/a through <= 2.3.

  • CVE-2026-22451CriMar 5, 2026
    WordPress
    Handyman
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in AncoraThemes Handyman handyman-services allows Object Injection.This issue affects Handyman: from n/a through <= 1.4.7.

  • CVE-2026-22417CriMar 5, 2026
    WordPress
    Grand Wedding
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Wedding grandwedding allows Object Injection.This issue affects Grand Wedding: from n/a through < 3.1.11.

  • CVE-2025-54001CriMar 5, 2026
    WordPress
    Classter
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in ThemeREX Classter classter allows Object Injection.This issue affects Classter: from n/a through <= 2.5.

  • CVE-2025-57622CriMar 3, 2026
    Step-Video-T2V
    Step-Video-T2V
    risk 0.64cvss 9.8epss 0.01

    An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loads(request.get_data()) component

  • CVE-2026-3422CriMar 2, 2026
    Edetw
    U Office Force
    risk 0.64cvss 9.8epss 0.01

    U-Office Force developed by e-Excellence has a Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized content.

  • CVE-2026-26222CriFeb 24, 2026
    Beyond
    Altec Doclink
    risk 0.64cvss 9.8epss 0.01

    Altec DocLink (now maintained by Beyond Limits Inc.) version 4.0.336.0 exposes insecure .NET Remoting endpoints over TCP and HTTP/SOAP via Altec.RDCHostService.exe using the ObjectURI "doclinkServer.soap". The service does not require authentication and is vulnerable to unsafe…