VYPR

CWE-502

Deserialization of Untrusted Data

BaseDraftLikelihood: Medium

Description

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-586

CVEs mapped to this weakness (3,308)

page 21 of 166
  • CVE-2026-22384CriFeb 20, 2026
    WordPress
    Applay - Shortcodes
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in leafcolor Applay - Shortcodes applay-shortcodes allows Object Injection.This issue affects Applay - Shortcodes: from n/a through <= 3.7.

  • CVE-2025-69405CriFeb 20, 2026
    WordPress
    Lorem Ipsum | Books & Media Store
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in ThemeREX Lorem Ipsum | Books & Media Store lorem-ipsum-books-media-store allows Object Injection.This issue affects Lorem Ipsum | Books & Media Store: from n/a through <= 1.2.11.

  • CVE-2025-69404CriFeb 20, 2026
    WordPress
    Extreme Store
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in ThemeREX Extreme Store extremestore allows Object Injection.This issue affects Extreme Store: from n/a through <= 1.5.10.

  • CVE-2025-69382CriFeb 20, 2026
    WordPress
    Themesflat Elementor
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in themesflat Themesflat Elementor themesflat-elementor allows Object Injection.This issue affects Themesflat Elementor: from n/a through <= 1.0.1.

  • CVE-2025-69372CriFeb 20, 2026
    WordPress
    SevenHills
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in AncoraThemes SevenHills sevenhills allows Object Injection.This issue affects SevenHills: from n/a through <= 1.6.2.

  • CVE-2025-69371CriFeb 20, 2026
    WordPress
    Kindlycare
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in AncoraThemes KindlyCare kindlycare allows Object Injection.This issue affects KindlyCare: from n/a through <= 1.6.1.

  • CVE-2025-69370CriFeb 20, 2026
    WordPress
    Capella
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in ThemeGoods Capella capella allows Object Injection.This issue affects Capella: from n/a through <= 2.5.5.

  • CVE-2025-69329CriFeb 20, 2026
    WordPress
    Prestige
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in Jthemes Prestige prestige allows Object Injection.This issue affects Prestige: from n/a through < 1.4.1.

  • CVE-2025-69301CriFeb 20, 2026
    WordPress
    PhotoMe
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in ThemeGoods PhotoMe photome allows Object Injection.This issue affects PhotoMe: from n/a through <= 5.6.11.

  • CVE-2025-68541CriFeb 20, 2026
    WordPress
    Ippsum
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in BoldThemes Ippsum ippsum allows Object Injection.This issue affects Ippsum: from n/a through <= 1.2.0.

  • CVE-2025-67997CriFeb 20, 2026
    WordPress
    Travelicious
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in BoldThemes Travelicious travelicious allows Object Injection.This issue affects Travelicious: from n/a through < 1.6.7.

  • CVE-2025-67996CriFeb 20, 2026
    WordPress
    Nestin
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in BoldThemes Nestin nestin allows Object Injection.This issue affects Nestin: from n/a through < 1.2.6.

  • CVE-2025-67995CriFeb 20, 2026
    WordPress
    PatioTime
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in LoftOcean PatioTime patiotime allows Object Injection.This issue affects PatioTime: from n/a through < 2.1.

  • CVE-2026-23549CriFeb 19, 2026
    WordPress
    Wpevently
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 5.1.1.

  • CVE-2026-23542CriFeb 19, 2026
    WordPress
    Grand Restaurant
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0.10.

  • CVE-2026-26333CriFeb 13, 2026
    Calero
    VeraSMART
    risk 0.64cvss 9.8epss 0.01

    Calero VeraSMART versions prior to 2022 R1 expose an unauthenticated .NET Remoting HTTP service on TCP port 8001. The service publishes default ObjectURIs (including EndeavorServer.rem and RemoteFileReceiver.rem) and permits the use of SOAP and binary formatters with…

  • CVE-2026-26221CriFeb 13, 2026
    Hyland
    OnBase
    risk 0.64cvss 9.8epss 0.01

    Hyland OnBase contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). An attacker who can reach the service can send crafted .NET Remoting requests to default HTTP channel endpoints on TCP/8900 (e.g.,…

  • CVE-2025-69872CriFeb 11, 2026
    Grantjenks
    Python Diskcache
    risk 0.64cvss 9.8epss 0.01

    DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. An attacker with write access to the cache directory can achieve arbitrary code execution when a victim application reads from the cache.

  • CVE-2026-21531CriFeb 10, 2026
    Microsoft
    Azure Conversation Authoring Client Library
    risk 0.64cvss 9.8epss 0.02

    Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.

  • CVE-2020-37071CriFeb 3, 2026
    Craftcms
    vCard Plugin
    risk 0.64cvss 9.8epss 0.01

    CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted payload. Attackers can generate a malicious serialized payload that triggers remote code execution by exploiting the…