VYPR

CWE-502

Deserialization of Untrusted Data

BaseDraftLikelihood: Medium

Description

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-586

CVEs mapped to this weakness (3,104)

page 21 of 156
  • CVE-2025-61168CriNov 25, 2025
    Sigb
    Pmb
    risk 0.64cvss 9.8epss 0.00

    An issue in the cms_rest.php component of SIGB PMB v8.0.1.14 allows attackers to execute arbitrary code via unserializing an arbitrary file.

  • CVE-2025-59245CriNov 20, 2025
    Microsoft
    Sharepoint Online
    risk 0.64cvss 9.8epss 0.01

    Microsoft SharePoint Online Elevation of Privilege Vulnerability

  • CVE-2025-11367CriNov 12, 2025
    N-able
    N-central
    risk 0.64cvss 9.8epss 0.01

    The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization

  • CVE-2025-60245CriNov 6, 2025
    WordPress
    Wp User Manager
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in WP User Manager WP User Manager wp-user-manager allows Object Injection.This issue affects WP User Manager: from n/a through <= 2.9.12.

  • CVE-2025-58998CriNov 6, 2025
    WordPress
    S2member
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in Cristián Lávaque s2Member s2member allows Object Injection.This issue affects s2Member: from n/a through <= 250701.

  • CVE-2025-58636CriNov 6, 2025
    WordPress
    WP Gravity Forms Keap/Infusionsoft
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Object Injection.This issue affects WP Gravity Forms Keap/Infusionsoft: from n/a through <= 1.2.3.

  • CVE-2025-53242CriNov 6, 2025
    WordPress
    Seil
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in VictorThemes Seil seil allows Object Injection.This issue affects Seil: from n/a through <= 1.7.1.

  • CVE-2025-49393CriNov 6, 2025
    WordPress
    Sign Up Sheets
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Object Injection.This issue affects Sign-up Sheets: from n/a through <= 2.3.2.

  • CVE-2025-62025CriOct 22, 2025
    WordPress
    Wp Jobsearch
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch.This issue affects JobSearch: from n/a through < 3.0.8.

  • CVE-2025-60238CriOct 22, 2025
    WordPress
    Universam Demo
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in universam UNIVERSAM universam-demo allows Object Injection.This issue affects UNIVERSAM: from n/a through <= 9.04.02.

  • CVE-2025-60232CriOct 22, 2025
    WordPress
    KBx Pro Ultimate
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in quantumcloud KBx Pro Ultimate knowledgebase-helpdesk-pro allows Object Injection.This issue affects KBx Pro Ultimate: from n/a through <= 8.0.5.

  • CVE-2025-60226CriOct 22, 2025
    Axiomthemes
    White Rabbit
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in axiomthemes White Rabbit whiterabbit allows Object Injection.This issue affects White Rabbit: from n/a through <= 1.5.2.

  • CVE-2025-60225CriOct 22, 2025
    WordPress
    BugsPatrol
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in AncoraThemes BugsPatrol bugspatrol allows Object Injection.This issue affects BugsPatrol: from n/a through <= 1.5.0.

  • CVE-2025-60224CriOct 22, 2025
    WordPress
    Subscribe To Download
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in wpshuffle Subscribe to Download subscribe-to-download allows Object Injection.This issue affects Subscribe to Download: from n/a through <= 2.0.9.

  • CVE-2025-60221CriOct 22, 2025
    captivateaudio
    captivatesync-trade
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Object Injection.This issue affects Captivate Sync: from n/a through <= 3.0.3.

  • CVE-2025-60216CriOct 22, 2025
    WordPress
    Addison
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in BoldThemes Addison addison allows Object Injection.This issue affects Addison: from n/a through < 1.4.8.

  • CVE-2025-60214CriOct 22, 2025
    WordPress
    Goldenblatt
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in BoldThemes Goldenblatt goldenblatt allows Object Injection.This issue affects Goldenblatt: from n/a through < 1.3.0.

  • CVE-2025-60213CriOct 22, 2025
    WordPress
    Scape
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in Whitebox-Studio Scape scape allows Object Injection.This issue affects Scape: from n/a through <= 1.5.13.

  • CVE-2025-60210CriOct 22, 2025
    Wpeverest
    Everest Forms - Frontend Listing
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in wpeverest Everest Forms - Frontend Listing everest-forms-frontend-listing allows Object Injection.This issue affects Everest Forms - Frontend Listing: from n/a through <= 1.0.5.

  • CVE-2025-60209CriOct 22, 2025
    WordPress
    Connector for Gravity Forms and Google Sheets
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets wp-gravity-forms-spreadsheets allows Object Injection.This issue affects Connector for Gravity Forms and Google Sheets: from n/a through <= 1.2.6.