← Back
CWE-502

3,199 CVEs • Abstraction: Base • Likelihood of Exploit: Medium

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

JSON object

Loading...

CVEs (3,199)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-51414
1Donweb
1Envialosimple\
Jun 17, 2026
Dec 29, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in EnvialoSimple EnvíaloSimple: Email Marketing y Newsletters.This issue affects EnvíaloSimple: Email Marketing y Newsletters: from n/a through 2.1.
CVE-2023-36381
1Gesundheit Bewegt
1Zippy
Jun 17, 2026
Dec 28, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.5.
CVE-2023-32795
1Woocommerce
1Product Addons
Jun 17, 2026
Dec 28, 2023
N/A· v4
7.2 HIGH· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in WooCommerce Product Add-Ons.This issue affects Product Add-Ons: from n/a through 6.1.3.
CVE-2023-32513
1Givewp
1Givewp
Jun 17, 2026
Dec 28, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.3.
CVE-2023-51700
1Jamieblomerus
1Unofficial Mobile Bankid Integration
Jun 17, 2026
Dec 27, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Unofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your WordPress site. Prior to 1.0.1, WP-Mobile-BankID-Integration is affected by a vulnerability classified...Show more
Unofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your WordPress site. Prior to 1.0.1, WP-Mobile-BankID-Integration is affected by a vulnerability classified as a Deserialization of Untrusted Data vulnerability, specifically impacting scenarios where an attacker can manipulate the database. If unauthorized actors gain access to the database, they could exploit this vulnerability to execute object injection attacks. This could lead to unauthorized code execution, data manipulation, or data exfiltration within the WordPress environment. Users of the plugin should upgrade to version 1.0.1 (or later), where the serialization and deserialization of OrderResponse objects have been switched out to an array stored as JSON. A possible workaround for users unable to upgrade immediately is to enforce stricter access controls on the database, ensuring that only trusted and authorized entities can modify data. Additionally, implementing monitoring tools to detect unusual database activities could help identify and mitigate potential exploitation attempts. Show less
CVE-2022-34268
1Rws
1Worldserver
Jun 17, 2026
Dec 25, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
An issue was discovered in RWS WorldServer before 11.7.3. /clientLogin deserializes Java objects without authentication, leading to command execution on the host.
CVE-2023-49826
1Pencidesign
1Soledad
Jun 17, 2026
Dec 21, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Them...Show more
Deserialization of Untrusted Data vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme: from n/a through 8.4.1.Show less
CVE-2023-49778
1Dmry
1Sayfa Sayac
Jun 17, 2026
Dec 21, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in Hakan Demiray Sayfa Sayac.This issue affects Sayfa Sayac: from n/a through 2.6.
CVE-2023-32242
1Xtemos
1Woodmart
Jun 17, 2026
Dec 21, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in xtemos WoodMart - Multipurpose WooCommerce Theme.This issue affects WoodMart - Multipurpose WooCommerce Theme: from n/a through 1.0.36.
CVE-2023-51656
1Apache
1Iotdb
Jun 17, 2026
Dec 21, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4. Users are recommended to upgrade to version 1.2.2, which fixes the issue.
CVE-2022-47599
1Bitapps
1File Manager
Jun 17, 2026
Dec 20, 2023
N/A· v4
7.2 HIGH· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in File Manager by Bit Form Team File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager.This issue affects File Manager – 100% Free & O...Show more
Deserialization of Untrusted Data vulnerability in File Manager by Bit Form Team File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager.This issue affects File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager: from n/a through 5.2.7.Show less
CVE-2023-7018
1Huggingface
1Transformers
Jun 17, 2026
Dec 20, 2023
N/A· v4
7.8 HIGH· v3
N/A· v2
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.
CVE-2023-49773
1Bcorp Shortcodes Project
1Bcorp Shortcodes
Jun 17, 2026
Dec 20, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in Tim Brattberg BCorp Shortcodes.This issue affects BCorp Shortcodes: from n/a through 0.23.
CVE-2023-49772
1Phpbits
1Genesis Simple Love
Jun 17, 2026
Dec 20, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in Phpbits Creative Studio Genesis Simple Love.This issue affects Genesis Simple Love: from n/a through 2.0.
CVE-2023-28782
1Gravityforms
1Gravity Forms
Jun 17, 2026
Dec 20, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in Rocketgenius Inc. Gravity Forms.This issue affects Gravity Forms: from n/a through 2.7.3.
CVE-2023-47507
1Averta
1Master Slider Pro
Jun 17, 2026
Dec 20, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in Master Slider Master Slider Pro.This issue affects Master Slider Pro: from n/a through 3.6.5.
CVE-2023-46147
1Themify
1Ultra
Jun 17, 2026
Dec 20, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.
CVE-2023-40555
1Uxthemes
1Flatsome
Jun 17, 2026
Dec 20, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in UX-themes Flatsome | Multi-Purpose Responsive WooCommerce Theme.This issue affects Flatsome | Multi-Purpose Responsive WooCommerce Theme: from n/a through 3.17.5.
CVE-2023-34382
2Dokan
Wedevs
2Dokan
Dokan
Jun 17, 2026
Dec 19, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace...Show more
Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: from n/a through 3.7.19.Show less
CVE-2023-34027
1Rajarora795
1Recently Viewed Products
Jun 17, 2026
Dec 19, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in Rajnish Arora Recently Viewed Products.This issue affects Recently Viewed Products: from n/a through 1.0.0.