Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

CVEs (2,969)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-30227 - - Jun 17, 2026 Mar 28, 2024 N/A· v4 9.0 CRITICAL· v3 N/A· v2 Deserialization of Untrusted Data vulnerability in INFINITUM FORM Geo Controller.This issue affects Geo Controller: from n/a through 8.6.4.
CVE-2024-30226 1Wpdeveloper 1Betterdocs Jun 17, 2026 Mar 28, 2024 N/A· v4 9.0 CRITICAL· v3 N/A· v2 Deserialization of Untrusted Data vulnerability in WPDeveloper BetterDocs.This issue affects BetterDocs: from n/a through 3.3.3.
CVE-2024-30225 - - Jun 17, 2026 Mar 28, 2024 N/A· v4 10.0 CRITICAL· v3 N/A· v2 Deserialization of Untrusted Data vulnerability in WPENGINE, INC. WP Migrate.This issue affects WP Migrate: from n/a through 2.6.10.
CVE-2024-30224 1Wpxpo 1Wholesalex Jun 17, 2026 Mar 28, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Deserialization of Untrusted Data vulnerability in Wholesale Team WholesaleX.This issue affects WholesaleX: from n/a through 1.3.2.
CVE-2024-30223 1Reputeinfosystems 1Armember Jun 17, 2026 Mar 28, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.26.
CVE-2024-30222 1Reputeinfosystems 1Armember Jun 17, 2026 Mar 28, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.26.
CVE-2024-1770 - - Jun 17, 2026 Mar 28, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 The Meta Tag Manager plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.2 via deserialization of untrusted input in the get_post_data function. This makes it possible for...Show more The Meta Tag Manager plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.2 via deserialization of untrusted input in the get_post_data function. This makes it possible for authenticated attackers, with contributor access or higher, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.Show less
CVE-2024-24842 - - Jun 17, 2026 Mar 27, 2024 N/A· v4 8.7 HIGH· v3 N/A· v2 Deserialization of Untrusted Data vulnerability in Echo Plugins Knowledge Base for Documentation, FAQs with AI Assistance.This issue affects Knowledge Base for Documentation, FAQs with AI Assistance: from n/a through 11....Show more Deserialization of Untrusted Data vulnerability in Echo Plugins Knowledge Base for Documentation, FAQs with AI Assistance.This issue affects Knowledge Base for Documentation, FAQs with AI Assistance: from n/a through 11.30.2.Show less
CVE-2023-27459 1Wpeverest 1User Registration & Membership Jun 17, 2026 Mar 26, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 Deserialization of Untrusted Data vulnerability in WPEverest User Registration.This issue affects User Registration: from n/a through 2.3.2.1.
CVE-2024-24725 1Gibbonedu 1Gibbon Jun 17, 2026 Mar 23, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI.
CVE-2024-2025 - - Jun 17, 2026 Mar 23, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 The "BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages" plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.20 via deserialization of untruste...Show more The "BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages" plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.20 via deserialization of untrusted input in the get_simple_request function. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. CVE-2024-32603 is likely a duplicate of this issue.Show less
CVE-2024-28861 1Friendsofsymfony1 1Symfony1 Jun 17, 2026 Mar 22, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Symfony 1 is a community-driven fork of the 1.x branch of Symfony, a PHP framework for web projects. Starting in version 1.1.0 and prior to version 1.5.19, Symfony 1 has a gadget chain due to dangerous deserialization in...Show more Symfony 1 is a community-driven fork of the 1.x branch of Symfony, a PHP framework for web projects. Starting in version 1.1.0 and prior to version 1.5.19, Symfony 1 has a gadget chain due to dangerous deserialization in `sfNamespacedParameterHolder` class that would enable an attacker to get remote code execution if a developer deserializes user input in their project. Version 1.5.19 contains a patch for the issue.Show less
CVE-2024-2054 1Articatech 1Artica Proxy Jun 17, 2026 Mar 21, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user.
CVE-2024-29032 1Ibm 1Qiskit Ibm Runtime Jun 17, 2026 Mar 20, 2024 N/A· v4 7.8 HIGH· v3 N/A· v2 Qiskit IBM Runtime is an environment that streamlines quantum computations and provides optimal implementations of the Qiskit quantum computing SDK. Starting in version 0.1.0 and prior to version 0.21.2, deserializing js...Show more Qiskit IBM Runtime is an environment that streamlines quantum computations and provides optimal implementations of the Qiskit quantum computing SDK. Starting in version 0.1.0 and prior to version 0.21.2, deserializing json data using `qiskit_ibm_runtime.RuntimeDecoder` can lead to arbitrary code execution given a correctly formatted input string. Version 0.21.2 contains a fix for this issue.Show less
CVE-2024-1856 1Progress 1Telerik Reporting Jun 17, 2026 Mar 20, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 In Progress® Telerik® Reporting versions prior to 2024 Q1 (18.0.24.130), a code execution attack is possible by a remote threat actor through an insecure deserialization vulnerability.
CVE-2024-1801 1Progress 1Telerik Reporting Jun 17, 2026 Mar 20, 2024 N/A· v4 7.8 HIGH· v3 N/A· v2 In Progress® Telerik® Reporting versions prior to 2024 Q1 (18.0.24.130), a code execution attack is possible by a local threat actor through an insecure deserialization vulnerability.
CVE-2024-1800 1Progress 1Telerik Report Server Jun 17, 2026 Mar 20, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability.
CVE-2024-2721 1Sygnoos 1Social Media Share Buttons Jun 17, 2026 Mar 20, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 Deserialization of Untrusted Data vulnerability in Social Media Share Buttons By Sygnoos Social Media Share Buttons.This issue affects Social Media Share Buttons: from n/a through 2.1.0.
CVE-2024-29136 1Themefic 1Tourfic Jun 17, 2026 Mar 19, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 Deserialization of Untrusted Data vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.17.
CVE-2024-2229 - - Jun 17, 2026 Mar 18, 2024 N/A· v4 7.8 HIGH· v3 N/A· v2 CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution when a malicious project file is loaded into the application by a valid user.

Previous 1...848586...149 Next