VYPR

CWE-502

Deserialization of Untrusted Data

BaseDraftLikelihood: Medium

Description

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-586

CVEs mapped to this weakness (3,116)

page 61 of 156
  • CVE-2025-60234HigOct 22, 2025
    WordPress
    Single Property
    risk 0.57cvss 8.8epss 0.01

    Deserialization of Untrusted Data vulnerability in designthemes Single Property single-property allows Object Injection.This issue affects Single Property: from n/a through <= 2.8.

  • CVE-2025-60228HigOct 22, 2025
    WordPress
    Knowledgebase
    risk 0.57cvss 8.8epss 0.01

    Deserialization of Untrusted Data vulnerability in designthemes Knowledge Base kbase allows Object Injection.This issue affects Knowledge Base: from n/a through <= 2.9.

  • CVE-2025-60215HigOct 22, 2025
    WordPress
    Kriya
    risk 0.57cvss 8.8epss 0.01

    Deserialization of Untrusted Data vulnerability in designthemes Kriya kriya allows Object Injection.This issue affects Kriya: from n/a through <= 3.4.

  • CVE-2025-60212HigOct 22, 2025
    WordPress
    VEDA
    risk 0.57cvss 8.8epss 0.01

    Deserialization of Untrusted Data vulnerability in designthemes VEDA veda allows Object Injection.This issue affects VEDA: from n/a through <= 4.2.

  • CVE-2025-52740HigOct 22, 2025
    WordPress
    Boldermail
    risk 0.57cvss 8.8epss 0.01

    Deserialization of Untrusted Data vulnerability in Hernan Villanueva Boldermail boldermail allows Object Injection.This issue affects Boldermail: from n/a through <= 2.4.0.

  • CVE-2025-52737HigOct 22, 2025
    WordPress
    Wp Store Locator
    risk 0.57cvss 8.8epss 0.00

    Deserialization of Untrusted Data vulnerability in Tijmen Smit WP Store Locator wp-store-locator allows Object Injection.This issue affects WP Store Locator: from n/a through <= 2.2.260.

  • CVE-2025-32283HigOct 22, 2025
    WordPress
    Solar Energy
    risk 0.57cvss 8.8epss 0.01

    Deserialization of Untrusted Data vulnerability in designthemes Solar Energy solar allows Object Injection.This issue affects Solar Energy: from n/a through <= 3.5.

  • CVE-2025-31634HigOct 22, 2025
    WordPress
    Insurance
    risk 0.57cvss 8.8epss 0.01

    Deserialization of Untrusted Data vulnerability in designthemes Insurance insurance allows Object Injection.This issue affects Insurance: from n/a through <= 3.5.

  • CVE-2017-20208CriOct 18, 2025
    WordPress
    Registrationmagic
    risk 0.57cvss 9.8epss 0.01

    The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.7.9.3 (exclusive) via deserialization of untrusted input from the is_expired_by_date() function.…

  • CVE-2017-20207CriOct 18, 2025
    WordPress
    Flickr Gallery
    risk 0.57cvss 9.8epss 0.01

    The Flickr Gallery plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.5.2 via deserialization of untrusted input from the `pager ` parameter. This allows unauthenticated attackers to inject a PHP Object. Attackers were actively…

  • CVE-2017-20206CriOct 18, 2025
    Wpmudev
    Appointments
    risk 0.57cvss 9.8epss 0.01

    The Appointments plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.2.1 via deserialization of untrusted input from the `wpmudev_appointments` cookie. This allows unauthenticated attackers to inject a PHP Object. Attackers were…

  • CVE-2025-49655CriOct 17, 2025
    Keras Team
    Keras
    risk 0.57cvss 9.8epss 0.01

    Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded…

  • CVE-2025-59237HigOct 14, 2025
    Microsoft
    Office SharePoint
    risk 0.57cvss 8.8epss 0.02

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  • CVE-2025-56816HigSep 24, 2025
    Datart
    Datart
    risk 0.57cvss 8.8epss 0.01

    Datart 1.0.0-rc.3 is vulnerable to Directory Traversal. The configuration file handling of the application allows attackers to upload arbitrary YAML files to the config/jdbc-driver-ext.yml path. The application parses this file using SnakeYAML's unsafe load() or loadAs() method…

  • CVE-2025-6544CriSep 21, 2025
    H2oai
    H2o 3
    risk 0.57cvss 9.8epss 0.01

    A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, which can be exploited by bypassing regular…

  • CVE-2025-10492CriSep 16, 2025
    Jaspersoft
    Jasperreports
    risk 0.57cvss 9.8epss 0.01

    A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library

  • CVE-2025-53303HigSep 9, 2025
    WordPress
    Thememove Core
    risk 0.57cvss 8.8epss 0.00

    Deserialization of Untrusted Data vulnerability in ThemeMove ThemeMove Core thememove-core allows Object Injection.This issue affects ThemeMove Core: from n/a through <= 1.4.2.

  • CVE-2025-48101HigSep 9, 2025
    WordPress
    Constant Contact for WordPress
    risk 0.57cvss 8.8epss 0.00

    Deserialization of Untrusted Data vulnerability in webdevstudios Constant Contact for WordPress allows Object Injection. This issue affects Constant Contact for WordPress: from n/a through 4.1.1.

  • CVE-2025-53691HigSep 3, 2025
    Sitecore
    Experience Platform (XP)
    risk 0.57cvss 8.8epss 0.02

    Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0…

  • CVE-2025-5662CriSep 2, 2025
    MySQL
    MySQL JDBC Driver
    risk 0.57cvss 9.8epss 0.01

    A deserialization vulnerability exists in the H2O-3 REST API (POST /99/ImportSQLTable) that affects all versions up to 3.46.0.7. This vulnerability allows remote code execution (RCE) due to improper validation of JDBC connection parameters when using a Key-Value format. The…