Weakness (CWE)
CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
How to prevent it (7 mitigations)
-
Architecture and Design, Implementation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
-
Implementation
When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
-
Implementation
Explicitly define a final object() to prevent deserialization.
-
Architecture and Design, Implementation
Make fields transient to protect them from deserialization.
An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.
-
Implementation
Avoid having unnecessary types or gadgets (a sequence of instances and method invocations that can self-execute during the deserialization process, often found in libraries) available that can be leveraged for malicious ends. This limits the potential for unintended or unauthorized types and gadgets to be leveraged by the attacker. Add only acceptable classes to an allowlist. Note: new gadgets are constantly being discovered, so this alone is not a sufficient mitigation.
-
Architecture and Design, Implementation
Employ cryptography of the data or code for protection. However, it's important to note that it would still be client-side security. This is risky because if the client is compromised then the security implemented on the client (the cryptography) can be bypassed.
-
Operation
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
Source: MITRE CWE-502
3,338 results · Feed
-
High 8.8
Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis
In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Values.read_file") is resolved by pickle's find_class through _getattribute to an arbitrary attribute path rather than to a module-level funct…
-
High 8.8
Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables
In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in sys.stdlib_module_names and the name is absent from the UNSAFE_IMPORTS denylist, …
-
High 7.3
Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code execution
Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. From 2023.0.101-rc until 2025.1.18, 2026.0.25 and 2026.1.19, the Windows Visual Studio integration deserializes local named-pipe messages without restricting which CLR types can …
-
High 8.8
WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.
-
High 7.2
WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.
-
Critical 9.8
WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.
-
High 8.8
WordPress GS Testimonial Slider plugin <= 3.3.10 - PHP Object Injection vulnerability
Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.
-
High 8.8
WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.
-
Critical 9.8
WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Injection.This issue affects FunnelKit Automations: from n/a through 3.8.6.1.
-
Critical 9.8
WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.
-
Medium 5.3
Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, the `course/certificate checkout` flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course …
-
Critical 9.8
LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization
InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickl…
-
Critical 9.4
Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution
A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted seri…
-
High 7.5
Chamilo LMS: Database-backed PHP object injection in career deserialization
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `public/main/cron/import_csv.php` call PHP's native `unserialize()` on `user_career.extra_data` retrieved from the database without the `allowed…
-
Critical 9.8CVE-2026-103039 Public exploit
Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field
The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unr…
-
High 7.5
Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer
The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when …
-
High 7.2
Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275
Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
-
Critical 9.3
A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veea…
-
High 8.7
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account…
-
High 7.5
Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name
Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with…
-
High 8.8
WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Social Snap <= 1.5.4 versions.
-
High 8.8
WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability
Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.
-
High 7.2
WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Object Injection.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212.
-
High 7.2
WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.
-
High 7.2
WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability
Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.
-
High 8.8
WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.
-
High 8.8
WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability
Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.
-
High 7.2
WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.
-
High 8.8
WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.
-
High 7.2
WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.
-
High 8.8
WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.
-
High 8.8
WordPress Dynamic QR Code – generator plugin <= 1.0.1 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Dynamic QR Code – generator <= 1.0.1 versions.
-
High 8.8
WordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.
-
High 7.2
WordPress Zippy plugin <= 1.7.0 - PHP Object Injection vulnerability
Editor PHP Object Injection in Zippy <= 1.7.0 versions.
-
High 7.2
WordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerability
Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.
-
Critical 9.8
WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.
-
Critical 9.8
WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.
-
Critical 9.8
WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.
-
Critical 9.8
WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.
-
Critical 9.8
WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.