Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

CVEs (3,196)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-36726 1Etoilewebdesign 1Ultimate Reviews Jun 17, 2026 Jun 7, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The Ultimate Reviews plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.1.32 via deserialization of untrusted input in several vulnerable functions. This allows unauthenticated...Show more The Ultimate Reviews plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.1.32 via deserialization of untrusted input in several vulnerable functions. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin.Show less
CVE-2020-36718 1Ninjateam 1Gpdr Ccpa Compliance Support Jun 17, 2026 Jun 7, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The GDPR CCPA Compliance Support plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.3 via deserialization of untrusted input "njt_gdpr_allow_permissions" value. This allows una...Show more The GDPR CCPA Compliance Support plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.3 via deserialization of untrusted input "njt_gdpr_allow_permissions" value. This allows unauthenticated attackers to inject a PHP Object.Show less
CVE-2023-33963 1Dataease 1Dataease Jun 17, 2026 Jun 1, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 DataEase is an open source data visualization and analysis tool. Prior to version 1.18.7, a deserialization vulnerability exists in the DataEase datasource, which can be exploited to execute arbitrary code. The vulnerabi...Show more DataEase is an open source data visualization and analysis tool. Prior to version 1.18.7, a deserialization vulnerability exists in the DataEase datasource, which can be exploited to execute arbitrary code. The vulnerability has been fixed in v1.18.7. There are no known workarounds aside from upgrading.Show less
CVE-2023-2288 1Themeisle 1Otter Jun 17, 2026 May 30, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deserialization vulnerability on PHP < 8.0 using the phar:// strea...Show more The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deserialization vulnerability on PHP < 8.0 using the phar:// stream wrapper.Show less
CVE-2023-2500 1Granthweb 1Go Pricing Jun 17, 2026 May 25, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.3.19 via deserialization of untrusted input from the 'go_pricing' shortc...Show more The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.3.19 via deserialization of untrusted input from the 'go_pricing' shortcode 'data' parameter. This allows authenticated attackers, with subscriber-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.Show less
CVE-2022-4815 1Hitachi 2Vantara Pentaho Vantara Pentaho Business Analytics Server Jun 17, 2026 May 24, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods.
CVE-2023-27068 1Sitecore 1Experience Platform Jun 17, 2026 May 23, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationResult.aspx.
CVE-2023-31058 1Apache 1Inlong Jun 17, 2026 May 22, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers would bypass the 'autoDeserialize' option filtering by add...Show more Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers would bypass the 'autoDeserialize' option filtering by adding blanks. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7674 https://github.com/apache/inlong/pull/7674 to solve it. Show less
CVE-2023-32336 1Ibm 1Infosphere Information Server Jun 17, 2026 May 22, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 IBM InfoSphere Information Server 11.7 is affected by a remote code execution vulnerability due to insecure deserialization in an RMI service. IBM X-Force ID: 255285.
CVE-2023-31890 1Glazedlists 1Glazed Lists Jun 17, 2026 May 16, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An XML Deserialization vulnerability in glazedlists v1.11.0 allows an attacker to execute arbitrary code via the BeanXMLByteCoder.decode() parameter.
CVE-2023-20878 1Vmware 2Cloud Foundation Vrealize Operations Jun 17, 2026 May 12, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 VMware Aria Operations contains a deserialization vulnerability. A malicious actor with administrative privileges can execute arbitrary commands and disrupt the system.
CVE-2023-30899 1Siemens 1Siveillance Video Jun 17, 2026 May 9, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev12), Siveillance Video 2021 R1 (All versions < V21.1 HotfixRev...Show more A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev12), Siveillance Video 2021 R1 (All versions < V21.1 HotfixRev12), Siveillance Video 2021 R2 (All versions < V21.2 HotfixRev8), Siveillance Video 2022 R1 (All versions < V22.1 HotfixRev7), Siveillance Video 2022 R2 (All versions < V22.2 HotfixRev5), Siveillance Video 2022 R3 (All versions < V22.3 HotfixRev2), Siveillance Video 2023 R1 (All versions < V23.1 HotfixRev1). The Management Server component of affected applications deserializes data without sufficient validations. This could allow an authenticated remote attacker to execute code on the affected system.Show less
CVE-2023-30898 1Siemens 1Siveillance Video Jun 17, 2026 May 9, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev12), Siveillance Video 2021 R1 (All versions < V21.1 HotfixRev...Show more A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev12), Siveillance Video 2021 R1 (All versions < V21.1 HotfixRev12), Siveillance Video 2021 R2 (All versions < V21.2 HotfixRev8), Siveillance Video 2022 R1 (All versions < V22.1 HotfixRev7), Siveillance Video 2022 R2 (All versions < V22.2 HotfixRev5), Siveillance Video 2022 R3 (All versions < V22.3 HotfixRev2), Siveillance Video 2023 R1 (All versions < V23.1 HotfixRev1). The Event Server component of affected applications deserializes data without sufficient validations. This could allow an authenticated remote attacker to execute code on the affected system.Show less
CVE-2023-1650 1Quantumcloud 1Wpbot Jun 17, 2026 May 8, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The AI ChatBot WordPress plugin before 4.4.7 unserializes user input from cookies via an AJAX action available to unauthenticated users, which could allow them to perform PHP Object Injection when a suitable gadget is pr...Show more The AI ChatBot WordPress plugin before 4.4.7 unserializes user input from cookies via an AJAX action available to unauthenticated users, which could allow them to perform PHP Object Injection when a suitable gadget is present on the blogShow less
CVE-2023-1347 1Fastlinemedia 1Customizer Export/import Jun 17, 2026 May 8, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 The Customizer Export/Import WordPress plugin before 0.9.6 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is...Show more The Customizer Export/Import WordPress plugin before 0.9.6 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is presentShow less
CVE-2023-1196 1Advancedcustomfields 1Advanced Custom Fields Jun 17, 2026 May 2, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Objec...Show more The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present.Show less
CVE-2023-1669 1Seopress 1Seopress Jun 17, 2026 May 2, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 The SEOPress WordPress plugin before 6.5.0.3 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
CVE-2023-1967 1Keysight 1N8844a Jun 17, 2026 Apr 27, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Keysight N8844A Data Analytics Web Service deserializes untrusted data without sufficiently verifying the resulting data will be valid.
CVE-2023-20853 1Aenrich 1A+hrd Jun 17, 2026 Apr 27, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ asynchronized message process. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary syst...Show more aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ asynchronized message process. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary system operation or disrupt service.Show less
CVE-2023-20852 1Aenrich 1A+hrd Jun 17, 2026 Apr 27, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to per...Show more aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary system operation or disrupt service.Show less

Previous 1...109110111...160 Next