CWE-502

Deserialization of Untrusted Data

BaseDraftLikelihood: Medium

Description

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Hierarchy (View 1000)

Parents

CWE-913

Children

none

Related attack patterns (CAPEC)

CAPEC-586

CVEs mapped to this weakness (1,721)

page 9 of 87

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2026-26221	Hyland OnBase	Cri	0.64	9.8	0.01	Feb 13, 2026	Hyland OnBase contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). An attacker who can reach the service can send crafted .NET Remoting requests to default HTTP channel endpoints on TCP/8900 (e.g.,…
CVE-2025-69872	Grantjenks Python Diskcache	Cri	0.64	9.8	0.01	Feb 11, 2026	DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. An attacker with write access to the cache directory can achieve arbitrary code execution when a victim application reads from the cache.
CVE-2020-37071	Craftcms vCard Plugin	Cri	0.64	9.8	0.01	Feb 3, 2026	CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted payload. Attackers can generate a malicious serialized payload that triggers remote code execution by exploiting the…
CVE-2026-0773	Upsonic Upsonic	Cri	0.64	9.8	0.01	Jan 23, 2026	Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Upsonic. Authentication is not required to exploit this vulnerability. The specific flaw…
CVE-2025-69079	Themerex Sound \| Musical Instruments Online Store	Cri	0.64	9.8	0.00	Jan 22, 2026	Deserialization of Untrusted Data vulnerability in ThemeREX Sound \| Musical Instruments Online Store musicplace allows Object Injection.This issue affects Sound \| Musical Instruments Online Store: from n/a through <= 1.6.9.
CVE-2025-67617	Themeton Consult Aid	Cri	0.64	9.8	0.01	Jan 22, 2026	Deserialization of Untrusted Data vulnerability in themeton Consult Aid consultaid allows Object Injection.This issue affects Consult Aid: from n/a through <= 1.4.3.
CVE-2025-67911	Tribulant Newsletters	Cri	0.64	9.8	0.00	Jan 8, 2026	Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through <= 4.11.
CVE-2025-47552	Digitalzoomstudio Video Gallery	Cri	0.64	9.8	0.00	Jan 7, 2026	Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This issue affects DZS Video Gallery: from n/a through 12.37.
CVE-2025-64233	Bold Themes Codiqa	Cri	0.64	9.8	0.00	Dec 18, 2025	Deserialization of Untrusted Data vulnerability in BoldThemes Codiqa codiqa allows Object Injection.This issue affects Codiqa: from n/a through < 1.2.8.
CVE-2025-64227	Boldgrid Client Invoicing by Sprout Invoices	Cri	0.64	9.8	0.00	Dec 18, 2025	Deserialization of Untrusted Data vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Object Injection.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.
CVE-2025-64206	WordPress Jannah	Cri	0.64	9.8	0.00	Dec 18, 2025	Deserialization of Untrusted Data vulnerability in TieLabs Jannah jannah allows Object Injection.This issue affects Jannah: from n/a through <= 7.6.0.
CVE-2025-54723	Bold Themes DentiCare	Cri	0.64	9.8	0.00	Dec 18, 2025	Deserialization of Untrusted Data vulnerability in BoldThemes DentiCare denticare allows Object Injection.This issue affects DentiCare: from n/a through < 1.4.3.
CVE-2025-60245	Wpusermanager Wp User Manager	Cri	0.64	9.8	0.00	Nov 6, 2025	Deserialization of Untrusted Data vulnerability in WP User Manager WP User Manager wp-user-manager allows Object Injection.This issue affects WP User Manager: from n/a through <= 2.9.12.
CVE-2025-58998	Cristián Lávaque s2Member	Cri	0.64	9.8	0.00	Nov 6, 2025	Deserialization of Untrusted Data vulnerability in Cristián Lávaque s2Member s2member allows Object Injection.This issue affects s2Member: from n/a through <= 250701.
CVE-2025-58636	WordPress Gf Infusionsoft	Cri	0.64	9.8	0.00	Nov 6, 2025	Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Object Injection.This issue affects WP Gravity Forms Keap/Infusionsoft: from n/a through <= 1.2.3.
CVE-2025-53242	VictorThemes Seil	Cri	0.64	9.8	0.00	Nov 6, 2025	Deserialization of Untrusted Data vulnerability in VictorThemes Seil seil allows Object Injection.This issue affects Seil: from n/a through <= 1.7.1.
CVE-2025-49393	Fetch Designs Sign Up Sheets	Cri	0.64	9.8	0.00	Nov 6, 2025	Deserialization of Untrusted Data vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Object Injection.This issue affects Sign-up Sheets: from n/a through <= 2.3.2.
CVE-2025-62025	WordPress Wp Jobsearch	Cri	0.64	9.8	0.01	Oct 22, 2025	Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch.This issue affects JobSearch: from n/a through < 3.0.8.
CVE-2025-60238	universam UNIVERSAM	Cri	0.64	9.8	0.01	Oct 22, 2025	Deserialization of Untrusted Data vulnerability in universam UNIVERSAM universam-demo allows Object Injection.This issue affects UNIVERSAM: from n/a through <= 9.04.02.
CVE-2025-60232	Quantumcloud KBx Pro Ultimate	Cri	0.64	9.8	0.01	Oct 22, 2025	Deserialization of Untrusted Data vulnerability in quantumcloud KBx Pro Ultimate knowledgebase-helpdesk-pro allows Object Injection.This issue affects KBx Pro Ultimate: from n/a through <= 8.0.5.

CVE-2026-26221CriFeb 13, 2026
Hyland
OnBase
risk 0.64cvss 9.8epss 0.01
Hyland OnBase contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). An attacker who can reach the service can send crafted .NET Remoting requests to default HTTP channel endpoints on TCP/8900 (e.g.,…
CVE-2025-69872CriFeb 11, 2026
Grantjenks
Python Diskcache
risk 0.64cvss 9.8epss 0.01
DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. An attacker with write access to the cache directory can achieve arbitrary code execution when a victim application reads from the cache.
CVE-2020-37071CriFeb 3, 2026
Craftcms
vCard Plugin
risk 0.64cvss 9.8epss 0.01
CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted payload. Attackers can generate a malicious serialized payload that triggers remote code execution by exploiting the…
CVE-2026-0773CriJan 23, 2026
Upsonic
Upsonic
risk 0.64cvss 9.8epss 0.01
Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Upsonic. Authentication is not required to exploit this vulnerability. The specific flaw…
CVE-2025-69079CriJan 22, 2026
Themerex
Sound | Musical Instruments Online Store
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in ThemeREX Sound | Musical Instruments Online Store musicplace allows Object Injection.This issue affects Sound | Musical Instruments Online Store: from n/a through <= 1.6.9.
CVE-2025-67617CriJan 22, 2026
Themeton
Consult Aid
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in themeton Consult Aid consultaid allows Object Injection.This issue affects Consult Aid: from n/a through <= 1.4.3.
CVE-2025-67911CriJan 8, 2026
Tribulant
Newsletters
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through <= 4.11.
CVE-2025-47552CriJan 7, 2026
Digitalzoomstudio
Video Gallery
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This issue affects DZS Video Gallery: from n/a through 12.37.
CVE-2025-64233CriDec 18, 2025
Bold Themes
Codiqa
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in BoldThemes Codiqa codiqa allows Object Injection.This issue affects Codiqa: from n/a through < 1.2.8.
CVE-2025-64227CriDec 18, 2025
Boldgrid
Client Invoicing by Sprout Invoices
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Object Injection.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.
CVE-2025-64206CriDec 18, 2025
WordPress
Jannah
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in TieLabs Jannah jannah allows Object Injection.This issue affects Jannah: from n/a through <= 7.6.0.
CVE-2025-54723CriDec 18, 2025
Bold Themes
DentiCare
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in BoldThemes DentiCare denticare allows Object Injection.This issue affects DentiCare: from n/a through < 1.4.3.
CVE-2025-60245CriNov 6, 2025
Wpusermanager
Wp User Manager
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in WP User Manager WP User Manager wp-user-manager allows Object Injection.This issue affects WP User Manager: from n/a through <= 2.9.12.
CVE-2025-58998CriNov 6, 2025
Cristián Lávaque
s2Member
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in Cristián Lávaque s2Member s2member allows Object Injection.This issue affects s2Member: from n/a through <= 250701.
CVE-2025-58636CriNov 6, 2025
WordPress
Gf Infusionsoft
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Object Injection.This issue affects WP Gravity Forms Keap/Infusionsoft: from n/a through <= 1.2.3.
CVE-2025-53242CriNov 6, 2025
VictorThemes
Seil
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in VictorThemes Seil seil allows Object Injection.This issue affects Seil: from n/a through <= 1.7.1.
CVE-2025-49393CriNov 6, 2025
Fetch Designs
Sign Up Sheets
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Object Injection.This issue affects Sign-up Sheets: from n/a through <= 2.3.2.
CVE-2025-62025CriOct 22, 2025
WordPress
Wp Jobsearch
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch.This issue affects JobSearch: from n/a through < 3.0.8.
CVE-2025-60238CriOct 22, 2025
universam
UNIVERSAM
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in universam UNIVERSAM universam-demo allows Object Injection.This issue affects UNIVERSAM: from n/a through <= 9.04.02.
CVE-2025-60232CriOct 22, 2025
Quantumcloud
KBx Pro Ultimate
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in quantumcloud KBx Pro Ultimate knowledgebase-helpdesk-pro allows Object Injection.This issue affects KBx Pro Ultimate: from n/a through <= 8.0.5.