CWE-502

Deserialization of Untrusted Data

BaseDraftLikelihood: Medium

Description

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Hierarchy (View 1000)

Parents

CWE-913

Children

none

Related attack patterns (CAPEC)

CAPEC-586

CVEs mapped to this weakness (3,308)

page 23 of 166

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2025-34394	Barracuda Networks Rmm	Cri	0.64	9.8	0.01	Dec 10, 2025	Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, exposes a .NET Remoting service that is insufficiently protected against deserialization of arbitrary types. This can lead to remote code execution.
CVE-2025-51746	jshERP Jsherp	Cri	0.64	9.8	0.00	Nov 25, 2025	An issue was discovered in jishenghua JSH_ERP 2.3.1. The /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks.
CVE-2025-51745	jshERP Jsherp	Cri	0.64	9.8	0.00	Nov 25, 2025	An issue was discovered in jishenghua JSH_ERP 2.3.1. The /role/addcan endpoint is vulnerable to fastjson deserialization attacks.
CVE-2025-51744	jshERP Jsherp	Cri	0.64	9.8	0.00	Nov 25, 2025	An issue was discovered in jishenghua JSH_ERP 2.3.1. The /user/addUser endpoint is vulnerable to fastjson deserialization attacks.
CVE-2025-51743	jshERP Jsherp	Cri	0.64	9.8	0.00	Nov 25, 2025	An issue was discovered in jishenghua JSH_ERP 2.3.1. The /materialCategory/addMaterialCategory endpoint is vulnerable to fastjson deserialization attacks.
CVE-2025-51742	jshERP Jsherp	Cri	0.64	9.8	0.00	Nov 25, 2025	An issue was discovered in jishenghua JSH_ERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parameter directly to parseObject(), introducing a Fastjson deserialization vulnerability that can lead to RCE via JDBC payloads.
CVE-2025-61168	Sigb Pmb	Cri	0.64	9.8	0.00	Nov 25, 2025	An issue in the cms_rest.php component of SIGB PMB v8.0.1.14 allows attackers to execute arbitrary code via unserializing an arbitrary file.
CVE-2025-59245	Microsoft Sharepoint Online	Cri	0.64	9.8	0.01	Nov 20, 2025	Microsoft SharePoint Online Elevation of Privilege Vulnerability
CVE-2025-11367	N-able N-central	Cri	0.64	9.8	0.01	Nov 12, 2025	The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization
CVE-2025-60245	WordPress Wp User Manager	Cri	0.64	9.8	0.00	Nov 6, 2025	Deserialization of Untrusted Data vulnerability in WP User Manager WP User Manager wp-user-manager allows Object Injection.This issue affects WP User Manager: from n/a through <= 2.9.12.
CVE-2025-58998	WordPress S2member	Cri	0.64	9.8	0.00	Nov 6, 2025	Deserialization of Untrusted Data vulnerability in Cristián Lávaque s2Member s2member allows Object Injection.This issue affects s2Member: from n/a through <= 250701.
CVE-2025-58636	WordPress WP Gravity Forms Keap/Infusionsoft	Cri	0.64	9.8	0.00	Nov 6, 2025	Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Object Injection.This issue affects WP Gravity Forms Keap/Infusionsoft: from n/a through <= 1.2.3.
CVE-2025-53242	WordPress Seil	Cri	0.64	9.8	0.00	Nov 6, 2025	Deserialization of Untrusted Data vulnerability in VictorThemes Seil seil allows Object Injection.This issue affects Seil: from n/a through <= 1.7.1.
CVE-2025-49393	WordPress Sign Up Sheets	Cri	0.64	9.8	0.01	Nov 6, 2025	Deserialization of Untrusted Data vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Object Injection.This issue affects Sign-up Sheets: from n/a through <= 2.3.2.
CVE-2025-62025	WordPress Wp Jobsearch	Cri	0.64	9.8	0.01	Oct 22, 2025	Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch.This issue affects JobSearch: from n/a through < 3.0.8.
CVE-2025-60238	WordPress Universam Demo	Cri	0.64	9.8	0.01	Oct 22, 2025	Deserialization of Untrusted Data vulnerability in universam UNIVERSAM universam-demo allows Object Injection.This issue affects UNIVERSAM: from n/a through <= 9.04.02.
CVE-2025-60232	WordPress KBx Pro Ultimate	Cri	0.64	9.8	0.01	Oct 22, 2025	Deserialization of Untrusted Data vulnerability in quantumcloud KBx Pro Ultimate knowledgebase-helpdesk-pro allows Object Injection.This issue affects KBx Pro Ultimate: from n/a through <= 8.0.5.
CVE-2025-60226	Axiomthemes White Rabbit	Cri	0.64	9.8	0.01	Oct 22, 2025	Deserialization of Untrusted Data vulnerability in axiomthemes White Rabbit whiterabbit allows Object Injection.This issue affects White Rabbit: from n/a through <= 1.5.2.
CVE-2025-60225	WordPress BugsPatrol	Cri	0.64	9.8	0.01	Oct 22, 2025	Deserialization of Untrusted Data vulnerability in AncoraThemes BugsPatrol bugspatrol allows Object Injection.This issue affects BugsPatrol: from n/a through <= 1.5.0.
CVE-2025-60224	WordPress Subscribe To Download	Cri	0.64	9.8	0.01	Oct 22, 2025	Deserialization of Untrusted Data vulnerability in wpshuffle Subscribe to Download subscribe-to-download allows Object Injection.This issue affects Subscribe to Download: from n/a through <= 2.0.9.

CVE-2025-34394CriDec 10, 2025
Barracuda Networks
Rmm
risk 0.64cvss 9.8epss 0.01
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, exposes a .NET Remoting service that is insufficiently protected against deserialization of arbitrary types. This can lead to remote code execution.
CVE-2025-51746CriNov 25, 2025
jshERP
Jsherp
risk 0.64cvss 9.8epss 0.00
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks.
CVE-2025-51745CriNov 25, 2025
jshERP
Jsherp
risk 0.64cvss 9.8epss 0.00
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /role/addcan endpoint is vulnerable to fastjson deserialization attacks.
CVE-2025-51744CriNov 25, 2025
jshERP
Jsherp
risk 0.64cvss 9.8epss 0.00
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /user/addUser endpoint is vulnerable to fastjson deserialization attacks.
CVE-2025-51743CriNov 25, 2025
jshERP
Jsherp
risk 0.64cvss 9.8epss 0.00
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /materialCategory/addMaterialCategory endpoint is vulnerable to fastjson deserialization attacks.
CVE-2025-51742CriNov 25, 2025
jshERP
Jsherp
risk 0.64cvss 9.8epss 0.00
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parameter directly to parseObject(), introducing a Fastjson deserialization vulnerability that can lead to RCE via JDBC payloads.
CVE-2025-61168CriNov 25, 2025
Sigb
Pmb
risk 0.64cvss 9.8epss 0.00
An issue in the cms_rest.php component of SIGB PMB v8.0.1.14 allows attackers to execute arbitrary code via unserializing an arbitrary file.
CVE-2025-59245CriNov 20, 2025
Microsoft
Sharepoint Online
risk 0.64cvss 9.8epss 0.01
Microsoft SharePoint Online Elevation of Privilege Vulnerability
CVE-2025-11367CriNov 12, 2025
N-able
N-central
risk 0.64cvss 9.8epss 0.01
The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization
CVE-2025-60245CriNov 6, 2025
WordPress
Wp User Manager
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in WP User Manager WP User Manager wp-user-manager allows Object Injection.This issue affects WP User Manager: from n/a through <= 2.9.12.
CVE-2025-58998CriNov 6, 2025
WordPress
S2member
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in Cristián Lávaque s2Member s2member allows Object Injection.This issue affects s2Member: from n/a through <= 250701.
CVE-2025-58636CriNov 6, 2025
WordPress
WP Gravity Forms Keap/Infusionsoft
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Object Injection.This issue affects WP Gravity Forms Keap/Infusionsoft: from n/a through <= 1.2.3.
CVE-2025-53242CriNov 6, 2025
WordPress
Seil
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in VictorThemes Seil seil allows Object Injection.This issue affects Seil: from n/a through <= 1.7.1.
CVE-2025-49393CriNov 6, 2025
WordPress
Sign Up Sheets
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Object Injection.This issue affects Sign-up Sheets: from n/a through <= 2.3.2.
CVE-2025-62025CriOct 22, 2025
WordPress
Wp Jobsearch
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch.This issue affects JobSearch: from n/a through < 3.0.8.
CVE-2025-60238CriOct 22, 2025
WordPress
Universam Demo
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in universam UNIVERSAM universam-demo allows Object Injection.This issue affects UNIVERSAM: from n/a through <= 9.04.02.
CVE-2025-60232CriOct 22, 2025
WordPress
KBx Pro Ultimate
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in quantumcloud KBx Pro Ultimate knowledgebase-helpdesk-pro allows Object Injection.This issue affects KBx Pro Ultimate: from n/a through <= 8.0.5.
CVE-2025-60226CriOct 22, 2025
Axiomthemes
White Rabbit
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in axiomthemes White Rabbit whiterabbit allows Object Injection.This issue affects White Rabbit: from n/a through <= 1.5.2.
CVE-2025-60225CriOct 22, 2025
WordPress
BugsPatrol
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in AncoraThemes BugsPatrol bugspatrol allows Object Injection.This issue affects BugsPatrol: from n/a through <= 1.5.0.
CVE-2025-60224CriOct 22, 2025
WordPress
Subscribe To Download
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in wpshuffle Subscribe to Download subscribe-to-download allows Object Injection.This issue affects Subscribe to Download: from n/a through <= 2.0.9.