CWE-502— Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.— MITRE CWE catalog

3,465 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-502page 16 of 70

CVE-2024-53913CRITICALCVSS 9.8EG 9.8
2024-11-24
An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24343. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
CVE-2024-53912CRITICALCVSS 9.8EG 9.8
2024-11-24
An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24341. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
CVE-2024-53911CRITICALCVSS 9.8EG 9.8
2024-11-24
An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24339. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
CVE-2024-53910CRITICALCVSS 9.8EG 9.8
2024-11-24
An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24336. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
CVE-2024-53909CRITICALCVSS 9.8EG 9.8
2024-11-24
An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24334. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
CVE-2024-9511CRITICALCVSS 9.8EG 9.8
2024-11-23
The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.82 via deserialization of unt…
CVE-2024-52443CRITICALCVSS 9.8EG 9.8
2024-11-20
Deserialization of Untrusted Data vulnerability in masikonis Geolocator geolocator allows Object Injection.This issue affects Geolocator: from n/a through <= 1.1.
CVE-2024-52440CRITICALCVSS 9.8EG 9.8
2024-11-20
Deserialization of Untrusted Data vulnerability in xpresslane Xpresslane Fast Checkout xpresslane-integration-for-woocommerce allows Object Injection.This issue affects Xpresslane Fast Checkout: from n/a through <= 1.0.0.
CVE-2024-52439CRITICALCVSS 9.8EG 9.8
2024-11-20
Deserialization of Untrusted Data vulnerability in Mark O'Donnell Team Rosters team-rosters allows Object Injection.This issue affects Team Rosters: from n/a through <= 4.8.2.
CVE-2024-52433CRITICALCVSS 9.8EG 9.8
2024-11-18
Deserialization of Untrusted Data vulnerability in Mindstien Technologies My Geo Posts Free my-geo-posts-free allows Object Injection.This issue affects My Geo Posts Free: from n/a through <= 1.2.
CVE-2024-52432CRITICALCVSS 9.8EG 9.8
2024-11-18
Deserialization of Untrusted Data vulnerability in NIX Solutions Ltd NIX Anti-Spam Light nix-anti-spam-light allows Object Injection.This issue affects NIX Anti-Spam Light: from n/a through <= 0.0.4.
CVE-2024-52430CRITICALCVSS 9.8EG 9.8
2024-11-18
Deserialization of Untrusted Data vulnerability in bublick Lis Video Gallery lis-video-gallery allows Object Injection.This issue affects Lis Video Gallery: from n/a through <= 0.2.1.
CVE-2024-52414CRITICALCVSS 9.8EG 9.8
2024-11-16
Deserialization of Untrusted Data vulnerability in Anthony Carbon WDES Responsive Mobile Menu wdes-responsive-mobile-menu allows Object Injection.This issue affects WDES Responsive Mobile Menu: from n/a through <= 5.3.18.
CVE-2024-52413CRITICALCVSS 9.8EG 9.8
2024-11-16
Deserialization of Untrusted Data vulnerability in dmcwebzone Airin Blog airin-blog allows Object Injection.This issue affects Airin Blog: from n/a through <= 1.6.1.
CVE-2024-52412CRITICALCVSS 9.8EG 9.8
2024-11-16
Deserialization of Untrusted Data vulnerability in Stephen Cui Xin allows Object Injection.This issue affects Xin: from n/a through 1.0.8.1.
CVE-2024-52411CRITICALCVSS 9.8EG 9.8
2024-11-16
Deserialization of Untrusted Data vulnerability in flowcraft Advanced Personalization personalization-by-flowcraft allows Object Injection.This issue affects Advanced Personalization: from n/a through <= 1.1.2.
CVE-2024-52410CRITICALCVSS 9.8EG 9.8
2024-11-16
Deserialization of Untrusted Data vulnerability in Phoenixheart Referrer Detector referrer-detector allows Object Injection.This issue affects Referrer Detector: from n/a through <= 4.2.1.0.
CVE-2024-52409CRITICALCVSS 9.8EG 9.8
2024-11-16
Deserialization of Untrusted Data vulnerability in Phoenixheart AJAX Random Posts ajax-random-posts allows Object Injection.This issue affects AJAX Random Posts: from n/a through <= 0.3.3.
CVE-2021-3838CRITICALCVSS 9.8EG 9.8
2024-11-15
DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function. An attacker who can upload files of any type to the server can pass in the…
CVE-2024-48112CRITICALCVSS 9.8EG 9.8
2024-10-30
A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
CVE-2024-10456CRITICALCVSS 9.8EG 9.8
2024-10-30
Delta Electronics InfraSuite Device Master versions prior to 1.0.12 are affected by a deserialization vulnerability that targets the Device-Gateway, which could allow deserialization of arbitrary .NET objects prior to authentication.
CVE-2024-50507CRITICALCVSS 9.8EG 9.8
2024-10-30
Deserialization of Untrusted Data vulnerability in Daschmi DS.DownloadList dsdownloadlist allows Object Injection.This issue affects DS.DownloadList: from n/a through <= 1.3.
CVE-2024-48206CRITICALCVSS 9.8EG 9.8
2024-10-29
A Deserialization of Untrusted Data vulnerability in chainer v7.8.1.post1 leads to execution of arbitrary code.
CVE-2024-48063CRITICALCVSS 9.8EG 9.8
2024-10-29
In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distributed computing.
CVE-2024-49625CRITICALCVSS 9.8EG 9.8
2024-10-20
Deserialization of Untrusted Data vulnerability in sphoid SiteBuilder Dynamic Components sitebuilder-dynamic-components allows Object Injection.This issue affects SiteBuilder Dynamic Components: from n/a through <= 1.0.
CVE-2024-49624CRITICALCVSS 9.8EG 9.8
2024-10-20
Deserialization of Untrusted Data vulnerability in smartdevth Advanced Advertising System advanced-advertising-system allows Object Injection.This issue affects Advanced Advertising System: from n/a through <= 1.3.1.
CVE-2024-49332CRITICALCVSS 9.8EG 9.8
2024-10-20
Deserialization of Untrusted Data vulnerability in giveawayboost Giveaway Boost giveaway-boost allows Object Injection.This issue affects Giveaway Boost: from n/a through <= 2.1.4.
CVE-2024-49626CRITICALCVSS 9.8EG 9.8
2024-10-20
Deserialization of Untrusted Data vulnerability in Piyush Patel Shipyaari Shipping Management shipyaari-shipping-managment allows Object Injection.This issue affects Shipyaari Shipping Management: from n/a through <= 1.2.
CVE-2024-49318CRITICALCVSS 9.8EG 9.8
2024-10-17
Deserialization of Untrusted Data vulnerability in Scott My Reading Library my-reading-library allows Object Injection.This issue affects My Reading Library: from n/a through <= 1.0.
CVE-2024-49227CRITICALCVSS 9.8EG 9.8
2024-10-16
Deserialization of Untrusted Data vulnerability in foter Free Stock Photos Foter free-stock-photos-foter allows Object Injection.This issue affects Free Stock Photos Foter: from n/a through <= 1.5.4.
CVE-2024-49218CRITICALCVSS 9.8EG 9.8
2024-10-16
Deserialization of Untrusted Data vulnerability in Al Imran Akash Recently recently-viewed-most-viewed-and-sold-products-for-woocommerce allows Object Injection.This issue affects Recently: from n/a through <= 1.1.
CVE-2024-48030CRITICALCVSS 9.8EG 9.8
2024-10-16
Deserialization of Untrusted Data vulnerability in Webextends Telecash Ricaricaweb telecash-ricaricaweb allows Object Injection.This issue affects Telecash Ricaricaweb: from n/a through <= 2.2.
CVE-2024-48028CRITICALCVSS 9.8EG 9.8
2024-10-16
Deserialization of Untrusted Data vulnerability in Boyan Raichev IP Loc8 ip-loc8 allows Object Injection.This issue affects IP Loc8: from n/a through <= 1.1.
CVE-2024-48026CRITICALCVSS 9.8EG 9.8
2024-10-16
Deserialization of Untrusted Data vulnerability in GMRobbins Disc Golf Manager disc-golf-manager allows Object Injection.This issue affects Disc Golf Manager: from n/a through <= 1.0.0.
CVE-2024-9634CRITICALCVSS 9.8EG 9.8
2024-10-16
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.3 via deserialization of untrusted input from the give_company_name parameter. Th…
CVE-2024-48033CRITICALCVSS 9.8EG 9.8
2024-10-11
Deserialization of Untrusted Data vulnerability in baptiste.gourdin Talkback talkback-secure-linkback-protocol allows Object Injection.This issue affects Talkback: from n/a through <= 1.0.
CVE-2024-47074CRITICALCVSS 9.8EG 9.8
2024-10-11
DataEase is an open source data visualization analysis tool. In Dataease, the PostgreSQL data source in the data source function can customize the JDBC connection parameters and the PG server target to be connected. In backend/src/main/jav…
CVE-2024-47636CRITICALCVSS 9.8EG 9.8
2024-10-10
Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch allows Object Injection.This issue affects JobSearch: from n/a through <= 2.5.9.
CVE-2024-22399CRITICALCVSS 9.8EG 9.8
2024-09-16
Deserialization of Untrusted Data vulnerability in Apache Seata. When developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests …
CVE-2024-41874CRITICALCVSS 9.8EG 9.8
2024-09-13
ColdFusion versions 2023.9, 2021.15 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerabilit…
CVE-2023-37227CRITICALCVSS 9.8EG 9.8
2024-09-10
Loftware Spectrum before 4.6 HF13 Deserializes Untrusted Data.
CVE-2024-44902CRITICALCVSS 9.8EG 9.8
2024-09-09
A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
CVE-2024-8255CRITICALCVSS 9.8EG 9.8
2024-08-29
Delta Electronics DTN Soft version 2.0.1 and prior are vulnerable to an attacker achieving remote code execution through a deserialization of untrusted data vulnerability.
CVE-2024-43931CRITICALCVSS 9.8EG 9.8
2024-08-29
Deserialization of Untrusted Data vulnerability in eyecix JobSearch allows Object Injection.This issue affects JobSearch: from n/a through 2.5.3.
CVE-2024-8030CRITICALCVSS 9.8EG 9.8
2024-08-28
The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the…
CVE-2024-5335CRITICALCVSS 9.8EG 9.8
2024-08-21
The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the…
CVE-2024-43354CRITICALCVSS 9.8EG 9.8
2024-08-19
Deserialization of Untrusted Data vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.7.2.
CVE-2024-43141CRITICALCVSS 9.8EG 9.8
2024-08-13
Deserialization of Untrusted Data vulnerability in Roland Barker, xnau webdesign Participants Database allows Object Injection.This issue affects Participants Database: from n/a through 2.5.9.2.
CVE-2024-6794CRITICALCVSS 9.8EG 9.8
2024-07-22
A deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabi…
CVE-2024-6793CRITICALCVSS 9.8EG 9.8
2024-07-22
A deserialization of untrusted data vulnerability exists in NI VeriStand DataLogging Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabili…

Map vulnerabilities like CWE-502 to your infrastructure

EchelonGraph correlates every CVE — across CWE-502 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →