Weakness (CWE)
CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
How to prevent it (7 mitigations)
-
Architecture and Design, Implementation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
-
Implementation
When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
-
Implementation
Explicitly define a final object() to prevent deserialization.
-
Architecture and Design, Implementation
Make fields transient to protect them from deserialization.
An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.
-
Implementation
Avoid having unnecessary types or gadgets (a sequence of instances and method invocations that can self-execute during the deserialization process, often found in libraries) available that can be leveraged for malicious ends. This limits the potential for unintended or unauthorized types and gadgets to be leveraged by the attacker. Add only acceptable classes to an allowlist. Note: new gadgets are constantly being discovered, so this alone is not a sufficient mitigation.
-
Architecture and Design, Implementation
Employ cryptography of the data or code for protection. However, it's important to note that it would still be client-side security. This is risky because if the client is compromised then the security implemented on the client (the cryptography) can be bypassed.
-
Operation
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
Source: MITRE CWE-502
3,352 results · Feed
-
High 8.4
Insecure .NET Remoting deserialization in Quanos SCHEMA ST4 Client Update Service allows local privilege escalation
Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service due to insecure deserialization in the .NET Remoting service. The service is configured with TypeFilterLevel.Full and is bound to local interfaces o…
-
Critical 9.8CVE-2026-54806 Public exploit
WordPress WP Activity Log plugin <= 5.6.3.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.
-
Critical 9.8
WordPress JetEngine plugin <= 3.8.10 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions.
-
Critical 9.8
WordPress Thrive Apprentice plugin < 10.8.10.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions.
-
Critical 9.8
WordPress JetEngine plugin <= 3.8.9.1 - PHP Object Injection vulnerability
Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions.
-
Critical 9.8
WordPress AI Lab theme < 5.4.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions.
-
High 8.1
WordPress EasyMeals theme <= 1.5.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions.
-
High 8.1
WordPress Reina theme <= 2.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Reina <= 2.1 versions.
-
Critical 9.8
WordPress WooCommerce Product Filters plugin < 2.0.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions.
-
High 8.1
WordPress Mildhill theme <= 1.5 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions.
-
High 8.1
WordPress Zermatt theme <= 1.6.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions.
-
Medium 6.5
WordPress Slimstat Analytics plugin < 5.4.0 - Deserialization of untrusted data vulnerability
Unauthenticated Deserialization of untrusted data in Slimstat Analytics < 5.4.0 versions.
-
Critical 9.8
WordPress ThemeREX Addons plugin <= 2.36.1.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1.
-
Medium 6.6
Counter Box <= 2.0.13 - Authenticated (Administrator+) PHP Object Injection via Import
The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input . This makes it possible for authenticated …
-
High 8.1
WordPress Valeska theme <= 1.2.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions.
-
High 8.1
WordPress Behold theme <= 1.5 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Behold <= 1.5 versions.
-
High 8.1
WordPress Esmée theme <= 1.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Esmée <= 1.4 versions.
-
High 8.1
WordPress Léonie theme <= 1.2.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions.
-
High 8.1
WordPress TechLink theme <= 1.3 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in TechLink <= 1.3 versions.
-
High 8.1
WordPress Roisin theme <= 1.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Roisin <= 1.4 versions.
-
High 8.1
WordPress Ashtanga theme <= 1.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions.
-
High 8.1
WordPress Laurits theme <= 1.5.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions.
-
High 8.1
WordPress LuxeDrive theme <= 1.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions.
-
High 8.1
WordPress Micdrop theme <= 1.3.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions.
-
High 8.1
WordPress Playroom theme <= 1.4.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions.
-
High 8.1
WordPress Valiance theme <= 1.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Valiance <= 1.2 versions.
-
High 8.1
WordPress NeoBeat theme <= 1.7 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions.
-
High 8.1
WordPress Santé theme <= 1.5.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions.
-
High 8.1
WordPress Fidalgo theme <= 1.2.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions.
-
Critical 9.8
WordPress Elementra theme <= 1.0.9 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions.
-
High 8.1
WordPress Alloggio - Hotel Booking theme <= 2.1.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions.
-
High 8.1
WordPress EmallShop theme <= 2.4.21 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in EmallShop <= 2.4.21 versions.
-
High 8.1
WordPress Kapee theme < 1.7.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Kapee < 1.7.0 versions.
-
Critical 9.8
WordPress Nifty theme <= 1.4.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions.
-
High 8.8
WordPress Fusion Builder plugin <= 3.15.3 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection.This issue affects Fusion Builder: from n/a through 3.15.3.
-
Critical 9.8
WordPress SeaFood Company theme <= 1.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions.
-
Critical 9.8
WordPress Hot Coffee theme <= 1.7 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Hot Coffee <= 1.7 versions.
-
Critical 9.8
WordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.
-
Critical 9.8
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are…
-
Medium 6.8
LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading
LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 4.1.0 and prior, the JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under con…