Weakness (CWE)
CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
How to prevent it (7 mitigations)
-
Architecture and Design, Implementation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
-
Implementation
When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
-
Implementation
Explicitly define a final object() to prevent deserialization.
-
Architecture and Design, Implementation
Make fields transient to protect them from deserialization.
An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.
-
Implementation
Avoid having unnecessary types or gadgets (a sequence of instances and method invocations that can self-execute during the deserialization process, often found in libraries) available that can be leveraged for malicious ends. This limits the potential for unintended or unauthorized types and gadgets to be leveraged by the attacker. Add only acceptable classes to an allowlist. Note: new gadgets are constantly being discovered, so this alone is not a sufficient mitigation.
-
Architecture and Design, Implementation
Employ cryptography of the data or code for protection. However, it's important to note that it would still be client-side security. This is risky because if the client is compromised then the security implemented on the client (the cryptography) can be bypassed.
-
Operation
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
Source: MITRE CWE-502
1,209 results · Clear filters · Feed
-
Critical 9.0
Critical Remote Code Execution (RCE) vulnerability reported in Windchill
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
-
Critical 9.5CVE-2026-126187 Public exploit
React: Unauthenticated Remote Code Execution in React Server Components
React is a JavaScript library for building user interfaces. From 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1, the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages are vulnerable to unauthenticated remote code exe…
-
Critical 9.8
WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Object Injection.This issue affects Radius Booking — Booking Calendar for Appointments & Services: fr…
-
Critical 9.8
Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability
Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authenti…
-
Critical 9.4
Report Deserialization Code Execution
Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by sub…
-
Critical 9.8
Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated att…
-
Critical 9.8
Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder
**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0…
-
Critical 9.8
PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field
The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This is due to insufficient sanitization of th…
-
Critical 9.8
WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.
-
Critical 9.8
WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Injection.This issue affects FunnelKit Automations: from n/a through 3.8.6.1.
-
Critical 9.8
WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.
-
Critical 9.8
LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization
InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickl…
-
Critical 9.4
Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution
A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted seri…
-
Critical 9.8CVE-2026-103039 Public exploit
Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field
The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unr…
-
Critical 9.3
A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veea…
-
Critical 9.8
WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.
-
Critical 9.8
WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.
-
Critical 9.8
WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.
-
Critical 9.8
WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.
-
Critical 9.8
WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.
-
Critical 9.8
WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.
-
Critical 9.8
WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.
-
Critical 9.8
WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.
-
Critical 9.8
WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.
-
Critical 9.8
WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.
-
Critical 9.8
WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.
-
Critical 9.8
WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.
-
Critical 9.8
WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.
-
Critical 9.8
WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.
-
Critical 9.8
WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.
-
Critical 9.8
WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Mission <= 1.22 versions.
-
Critical 9.8
WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.
-
Critical 9.8
WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.
-
Critical 9.8
WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.
-
Critical 9.8
WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.
-
Critical 9.8
WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.
-
Critical 9.8
WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.
-
Critical 9.8
WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.
-
Critical 9.8
WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.
-
Critical 9.8
WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.