← Back
CWE-502

2,968 CVEs • Abstraction: Base • Likelihood of Exploit: Medium

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

JSON object

Loading...

CVEs (2,968)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-49442
1Jeecg
1Jeecg
Jun 17, 2026
Jan 3, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary code via crafted POST request.
CVE-2023-51785
1Apache
1Inlong
Jun 17, 2026
Jan 3, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.9.0, the attackers can make a arbitrary file read attack using mysql driver. Users are advised to up...Show more
Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.9.0, the attackers can make a arbitrary file read attack using mysql driver. Users are advised to upgrade to Apache InLong's 1.10.0 or cherry-pick [1] to solve it. [1]  https://github.com/apache/inlong/pull/9331Show less
CVE-2023-49777
1Yithemes
1Yith Woocommerce Product Add Ons
Jun 17, 2026
Dec 31, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Product Add-Ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.3.0.
CVE-2023-52182
1Ari Soft
1Ari Stream Quiz
Jun 17, 2026
Dec 31, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder.This issue affects ARI Stream Quiz – WordPress Quizzes Builder: from n/a through 1.3.0.
CVE-2023-52181
1Presslabs
1Theme Per User
Jun 17, 2026
Dec 31, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in Presslabs Theme per user.This issue affects Theme per user: from n/a through 1.0.1.
CVE-2023-51545
1Themehigh
1Job Manager & Career
Jun 17, 2026
Dec 29, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career – Manage job board listings, and recruitments.This issue affects Job Manager & Career – Manage job boar...Show more
Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career – Manage job board listings, and recruitments.This issue affects Job Manager & Career – Manage job board listings, and recruitments: from n/a through 1.4.4.Show less
CVE-2023-51505
1Pluginus
1Woot
Jun 17, 2026
Dec 29, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in realmag777 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store.This issue affects Active Products Tables for WooCommerce. Professi...Show more
Deserialization of Untrusted Data vulnerability in realmag777 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store.This issue affects Active Products Tables for WooCommerce. Professional products tables for WooCommerce store : from n/a through 1.0.6.Show less
CVE-2023-51470
1Boiteasite
1Rencontre
Jun 17, 2026
Dec 29, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in Jacques Malgrange Rencontre – Dating Site.This issue affects Rencontre – Dating Site: from n/a through 3.11.1.
CVE-2023-51422
1Saleswonder
1Webinarignition
Jun 17, 2026
Dec 29, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition.This issue affects Webinar Plugin: Create liv...Show more
Deserialization of Untrusted Data vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition.This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: from n/a through 3.05.0.Show less
CVE-2023-51414
1Donweb
1Envialosimple\
Jun 17, 2026
Dec 29, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in EnvialoSimple EnvíaloSimple: Email Marketing y Newsletters.This issue affects EnvíaloSimple: Email Marketing y Newsletters: from n/a through 2.1.
CVE-2023-36381
1Gesundheit Bewegt
1Zippy
Jun 17, 2026
Dec 28, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.5.
CVE-2023-32795
1Woocommerce
1Product Addons
Jun 17, 2026
Dec 28, 2023
N/A· v4
7.2 HIGH· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in WooCommerce Product Add-Ons.This issue affects Product Add-Ons: from n/a through 6.1.3.
CVE-2023-32513
1Givewp
1Givewp
Jun 17, 2026
Dec 28, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.3.
CVE-2023-51700
1Jamieblomerus
1Unofficial Mobile Bankid Integration
Jun 17, 2026
Dec 27, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Unofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your WordPress site. Prior to 1.0.1, WP-Mobile-BankID-Integration is affected by a vulnerability classified...Show more
Unofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your WordPress site. Prior to 1.0.1, WP-Mobile-BankID-Integration is affected by a vulnerability classified as a Deserialization of Untrusted Data vulnerability, specifically impacting scenarios where an attacker can manipulate the database. If unauthorized actors gain access to the database, they could exploit this vulnerability to execute object injection attacks. This could lead to unauthorized code execution, data manipulation, or data exfiltration within the WordPress environment. Users of the plugin should upgrade to version 1.0.1 (or later), where the serialization and deserialization of OrderResponse objects have been switched out to an array stored as JSON. A possible workaround for users unable to upgrade immediately is to enforce stricter access controls on the database, ensuring that only trusted and authorized entities can modify data. Additionally, implementing monitoring tools to detect unusual database activities could help identify and mitigate potential exploitation attempts. Show less
CVE-2022-34268
1Rws
1Worldserver
Jun 17, 2026
Dec 25, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
An issue was discovered in RWS WorldServer before 11.7.3. /clientLogin deserializes Java objects without authentication, leading to command execution on the host.
CVE-2023-49826
1Pencidesign
1Soledad
Jun 17, 2026
Dec 21, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Them...Show more
Deserialization of Untrusted Data vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme: from n/a through 8.4.1.Show less
CVE-2023-49778
1Dmry
1Sayfa Sayac
Jun 17, 2026
Dec 21, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in Hakan Demiray Sayfa Sayac.This issue affects Sayfa Sayac: from n/a through 2.6.
CVE-2023-32242
1Xtemos
1Woodmart
Jun 17, 2026
Dec 21, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in xtemos WoodMart - Multipurpose WooCommerce Theme.This issue affects WoodMart - Multipurpose WooCommerce Theme: from n/a through 1.0.36.
CVE-2023-51656
1Apache
1Iotdb
Jun 17, 2026
Dec 21, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4. Users are recommended to upgrade to version 1.2.2, which fixes the issue.
CVE-2022-47599
1Bitapps
1File Manager
Jun 17, 2026
Dec 20, 2023
N/A· v4
7.2 HIGH· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in File Manager by Bit Form Team File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager.This issue affects File Manager – 100% Free & O...Show more
Deserialization of Untrusted Data vulnerability in File Manager by Bit Form Team File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager.This issue affects File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager: from n/a through 5.2.7.Show less