Weakness (CWE)
CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
How to prevent it (7 mitigations)
-
Architecture and Design, Implementation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
-
Implementation
When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
-
Implementation
Explicitly define a final object() to prevent deserialization.
-
Architecture and Design, Implementation
Make fields transient to protect them from deserialization.
An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.
-
Implementation
Avoid having unnecessary types or gadgets (a sequence of instances and method invocations that can self-execute during the deserialization process, often found in libraries) available that can be leveraged for malicious ends. This limits the potential for unintended or unauthorized types and gadgets to be leveraged by the attacker. Add only acceptable classes to an allowlist. Note: new gadgets are constantly being discovered, so this alone is not a sufficient mitigation.
-
Architecture and Design, Implementation
Employ cryptography of the data or code for protection. However, it's important to note that it would still be client-side security. This is risky because if the client is compromised then the security implemented on the client (the cryptography) can be bypassed.
-
Operation
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
Source: MITRE CWE-502
3,347 results · Feed
-
High 8.8
WordPress VK Google Job Posting Manager plugin <= 1.3.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1.
-
High 8.8
WordPress Simple Event Planner plugin <= 1.5.7 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7.
-
High 7.2
WordPress Sunshine Photo Cart plugin <= 3.7.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1.
-
High 7.2
WordPress WP Ultimate Exporter plugin <= 3.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0.
-
High 7.2
WordPress Product Feed PRO for WooCommerce plugin <= 13.5.7 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7.
-
Critical 9.8
WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5.
-
High 8.1CVE-2026-104905 Public exploit
FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect
FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. A…
-
High 7.3
YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution
YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts t…
-
Critical 9.1
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of …
-
Critical 9.8
An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .…
-
Critical 9.8
Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements
Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's loadSchema() subschema search with a schema object that contains a serialized Java class, allowing some poten…
-
Critical 9.1
DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to remote code execution (RCE) via unsafe J…
-
High 7.7
Foreman: ssti and insecure deserialization in foreman-rake configuration
A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution c…
-
High 8.8
WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Icegram <= 3.1.31 versions.
-
High 7.2
WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.4 - PHP Object Injection vulnerability
Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.
-
High 7.2
Kiteworks Email Protection Gateway deserialization of untrusted data
An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context o…
-
Medium 6.6
Kiteworks Email Protection Gateway Deserialization of Untrusted Data
On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized object that was deserialized without sufficient validation, potentially allowing code execution as the gateway …
-
High 8.1
Kiteworks Core deserialization of untrusted data
Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain conditions, allow crafted data to be deserialized unsafely, potentially resulting in remote code executio…
-
High 7.2
WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 versions.
-
High 8.8
WordPress Photo Gallery by 10Web plugin <= 1.8.46 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.
-
Critical 9.8
WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.
-
High 8.8
WordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.
-
High 7.2
WordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerability
Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.
-
High 7.2CVE-2026-103441 Public exploit
Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing
Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.
-
Critical 9.8
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service
LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method. Attackers can reach the visual RPyC port and pass objects with __r…
-
Critical 9.8
WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.
-
Medium 4.9
WordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Object Injection.This issue affects ShortPixel Image Optimizer: from n/a through 6.5.5.
-
High 7.2
WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.
-
High 7.2
WordPress Content Egg plugin <= 6.3.1 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.
-
High 8.8
WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.
-
High 7.2
WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability
Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.
-
High 7.2
WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability
Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.
-
High 8.8
WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.
-
High 8.8
WordPress DesignSetGo plugin <= 2.8.0 - PHP Object Injection vulnerability
Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.
-
High 7.2
WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.
-
High 8.8
WordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.
-
High 7.2
WordPress Responsive Slider Gallery plugin <= 1.5.5 - PHP Object Injection vulnerability
Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.
-
High 8.8
WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.33.6 - PHP Object Injection vulnerability
Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.
-
High 8.8
WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability
Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.
-
High 7.2
WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.