VYPR

CWE-502

Deserialization of Untrusted Data

BaseDraftLikelihood: Medium

Description

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-586

CVEs mapped to this weakness (3,308)

page 22 of 166
  • CVE-2026-0773CriJan 23, 2026
    Upsonic
    Upsonic
    risk 0.64cvss 9.8epss 0.01

    Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Upsonic. Authentication is not required to exploit this vulnerability. The specific flaw…

  • CVE-2026-0764CriJan 23, 2026
    Binary Husky
    Gpt Academic
    risk 0.64cvss 9.8epss 0.01

    GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this vulnerability. The specific…

  • CVE-2026-0763CriJan 23, 2026
    Binary Husky
    Gpt Academic
    risk 0.64cvss 9.8epss 0.01

    GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this…

  • CVE-2026-0760CriJan 23, 2026
    Foundation Agents
    MetaGPT
    risk 0.64cvss 9.8epss 0.01

    Foundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foundation Agents MetaGPT. Authentication is not required to…

  • CVE-2025-69079CriJan 22, 2026
    WordPress
    Sound | Musical Instruments Online Store
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in ThemeREX Sound | Musical Instruments Online Store musicplace allows Object Injection.This issue affects Sound | Musical Instruments Online Store: from n/a through <= 1.6.9.

  • CVE-2025-67617CriJan 22, 2026
    WordPress
    Consult Aid
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in themeton Consult Aid consultaid allows Object Injection.This issue affects Consult Aid: from n/a through <= 1.4.3.

  • CVE-2023-7334CriJan 15, 2026
    Changjietong
    T+
    risk 0.64cvss 9.8epss 0.01

    Changjetong T+ versions up to and including 16.x contain a .NET deserialization vulnerability in an AjaxPro endpoint that can lead to remote code execution. A remote attacker can send a crafted request to /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetSt…

  • CVE-2025-67911CriJan 8, 2026
    WordPress
    Newsletters Lite
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through <= 4.11.

  • CVE-2025-47552CriJan 7, 2026
    WordPress
    Dzs Videogallery
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This issue affects DZS Video Gallery: from n/a through 12.37.

  • CVE-2025-64233CriDec 18, 2025
    WordPress
    Codiqa
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in BoldThemes Codiqa codiqa allows Object Injection.This issue affects Codiqa: from n/a through < 1.2.8.

  • CVE-2025-64227CriDec 18, 2025
    WordPress
    Client Invoicing by Sprout Invoices
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Object Injection.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.

  • CVE-2025-64206CriDec 18, 2025
    WordPress
    Jannah
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in TieLabs Jannah jannah allows Object Injection.This issue affects Jannah: from n/a through <= 7.6.0.

  • CVE-2025-60180CriDec 18, 2025
    Crmperks
    Wp Gravity Forms Salesforce
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Salesforce gf-salesforce-crmperks allows Object Injection.This issue affects WP Gravity Forms Salesforce: from n/a through <= 1.5.1.

  • CVE-2025-60178CriDec 18, 2025
    Crmperks
    Wp Gravity Forms Hubspot
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms HubSpot gf-hubspot allows Object Injection.This issue affects WP Gravity Forms HubSpot: from n/a through <= 1.2.6.

  • CVE-2025-60174CriDec 18, 2025
    Crmperks
    Wp Gravity Forms Constant Contact Plugin
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Constant Contact Plugin gf-constant-contact allows Object Injection.This issue affects WP Gravity Forms Constant Contact Plugin: from n/a through <= 1.1.2.

  • CVE-2025-60091CriDec 18, 2025
    Crmperks
    Wp Gravity Forms Zoho CRM And Bigin
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Zoho CRM and Bigin gf-zoho allows Object Injection.This issue affects WP Gravity Forms Zoho CRM and Bigin: from n/a through <= 1.2.9.

  • CVE-2025-60090CriDec 18, 2025
    Crmperks
    Wp Gravity Forms Insightly
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Insightly gf-insightly allows Object Injection.This issue affects WP Gravity Forms Insightly: from n/a through <= 1.1.6.

  • CVE-2025-60089CriDec 18, 2025
    Crmperks
    Wp Gravity Forms Freshdesk Plugin
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms FreshDesk Plugin gf-freshdesk allows Object Injection.This issue affects WP Gravity Forms FreshDesk Plugin: from n/a through <= 1.3.5.

  • CVE-2025-54723CriDec 18, 2025
    WordPress
    DentiCare
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in BoldThemes DentiCare denticare allows Object Injection.This issue affects DentiCare: from n/a through < 1.4.3.

  • CVE-2025-65213CriDec 15, 2025
    MooreThreads
    torch_musa
    risk 0.64cvss 9.8epss 0.01

    MooreThreads torch_musa through all versions contains an unsafe deserialization vulnerability in torch_musa.utils.compare_tool. The compare_for_single_op() and nan_inf_track_for_single_op() functions use pickle.load() on user-controlled file paths without validation, allowing…