CWE-502— Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.— MITRE CWE catalog

3,007 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-502page 25 of 61

CVE-2023-46227HIGHCVSS 7.5EG 7.5
2023-10-19
Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can use \t to bypass. Users are advised to upgrade to Apache InLong's …
CVE-2023-46279CRITICALCVSS 9.8EG 9.8
2023-12-15
Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5. Users are recommended to upgrade to the latest version, which fixes the issue.
CVE-2023-46302CRITICALCVSS 9.8EG 9.8
2023-11-20
Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vuln/detail/CVE-2022-1471 . Apache Submarine uses JAXRS to define REST endpoints. In order to handl…
CVE-2023-4643HIGHCVSS 8.8EG 8.8
2023-10-16
The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog
CVE-2023-46604CRITICALCVSS 9.8EG 9.8⚠ KEV
2023-10-27
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipul…
CVE-2023-46615MEDIUMCVSS 5.4EG 5.4
2024-02-12
Deserialization of Untrusted Data vulnerability in Kalli Dan. KD Coming Soon.This issue affects KD Coming Soon: from n/a through 1.7.
CVE-2023-46674HIGHCVSS 7.8EG 7.8
2023-12-05
An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon…
CVE-2023-46801HIGHCVSS 8.8EG 8.8
2024-07-15
In Apache Linkis <= 1.5.0, data source management module, when adding Mysql data source, exists remote code execution vulnerability for java version < 1.8.0_241. The deserialization vulnerability exploited through jrmp can inject maliciou…
CVE-2023-46817CRITICALCVSS 9.8EG 9.8
2023-11-03
An issue was discovered in phpFox before 4.8.14. The url request parameter passed to the /core/redirect route is not properly sanitized before being used in a call to the unserialize() PHP function. This can be exploited by remote, unauthe…
CVE-2023-46990CRITICALCVSS 9.8EG 9.8
2023-11-20
Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace function.
CVE-2023-47130CRITICALCVSS 9.8EG 9.8
2023-11-14
Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. An attacker may leverage this vulnerability to compr…
CVE-2023-47174CRITICALCVSS 9.8EG 9.8
2023-10-31
Thorn SFTP gateway 3.4.x before 3.4.4 uses Pivotal Spring Framework for Java deserialization of untrusted data, which is not supported by Pivotal, a related issue to CVE-2016-1000027. Also, within the specific context of Thorn SFTP gateway…
CVE-2023-47204CRITICALCVSS 9.8EG 9.8
2023-11-02
Unsafe YAML deserialization in yaml.Loader in transmute-core before 1.13.5 allows attackers to execute arbitrary Python code.
CVE-2023-47207CRITICALCVSS 9.8EG 9.8
2023-11-30
In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute code with local administrator privileges.
CVE-2023-47248CRITICALCVSS 9.8EG 9.8
2023-11-09
Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for exam…
CVE-2023-47507CRITICALCVSS 9.8EG 9.8
2023-12-20
Deserialization of Untrusted Data vulnerability in Master Slider Master Slider Pro.This issue affects Master Slider Pro: from n/a through 3.6.5.
CVE-2023-48886CRITICALCVSS 9.8EG 9.8
2023-12-01
A deserialization vulnerability in NettyRpc v1.2 allows attackers to execute arbitrary commands via sending a crafted RPC request.
CVE-2023-48887CRITICALCVSS 9.8EG 9.8
2023-12-01
A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request.
CVE-2023-48952HIGHCVSS 7.5EG 7.5
2023-11-29
An issue in the box_deserialize_reusing function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement.
CVE-2023-48967CRITICALCVSS 9.8EG 9.8
2023-12-04
Ssolon <= 2.6.0 and <=2.5.12 is vulnerable to Deserialization of Untrusted Data.
CVE-2023-49297HIGHCVSS 7.8EG 7.8
2023-12-05
PyDrive2 is a wrapper library of google-api-python-client that simplifies many common Google Drive API V2 tasks. Unsafe YAML deserilization will result in arbitrary code execution. A maliciously crafted YAML file can cause arbitrary code e…
CVE-2023-49442CRITICALCVSS 9.8EG 9.8
2024-01-03
Deserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary code via crafted POST request.
CVE-2023-49566HIGHCVSS 8.8EG 8.8
2024-07-15
In Apache Linkis <=1.5.0, due to the lack of effective filtering of parameters, an attacker configuring malicious db2 parameters in the DataSource Manager Module will result in jndi injection. Therefore, the parameters in the DB2 URL…
CVE-2023-4971HIGHCVSS 7.2EG 7.2
2023-10-16
The Weaver Xtreme Theme Support WordPress plugin before 6.3.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is…
CVE-2023-49772CRITICALCVSS 9.8EG 10.0
2023-12-20
Deserialization of Untrusted Data vulnerability in Phpbits Creative Studio Genesis Simple Love.This issue affects Genesis Simple Love: from n/a through 2.0.
CVE-2023-49773CRITICALCVSS 9.8EG 10.0
2023-12-20
Deserialization of Untrusted Data vulnerability in Tim Brattberg BCorp Shortcodes.This issue affects BCorp Shortcodes: from n/a through 0.23.
CVE-2023-49777CRITICALCVSS 8.8EG 9.1
2023-12-31
Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Product Add-Ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.3.0.
CVE-2023-49778CRITICALCVSS 9.8EG 10.0
2023-12-21
Deserialization of Untrusted Data vulnerability in Hakan Demiray Sayfa Sayac.This issue affects Sayfa Sayac: from n/a through 2.6.
CVE-2023-49819CRITICALCVSS 9.8EG 9.8
2023-12-19
Deserialization of Untrusted Data vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD) #wpsc.This issue affects Structured Content (JSON-LD) #wpsc: from n/a through 1.5.3.
CVE-2023-49826CRITICALCVSS 9.8EG 9.8
2023-12-21
Deserialization of Untrusted Data vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme: from n/a thr…
CVE-2023-49886CRITICALCVSS 9.8EG 9.8
2025-10-06
IBM Standards Processing Engine 10.0.1.10 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe java deserialization. By sending specially crafted input, an attacker could exploit this vulnerability to …
CVE-2023-5016CRITICALCVSS 9.8EG 9.8
2023-09-17
A vulnerability was found in spider-flow up to 0.5.0. It has been declared as critical. Affected by this vulnerability is the function DriverManager.getConnection of the file src/main/java/org/spiderflow/controller/DataSourceController.jav…
CVE-2023-50218HIGHCVSS 8.8EG 8.9
2024-05-03
Inductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Igniti…
CVE-2023-50219HIGHCVSS 8.8EG 8.8
2024-05-03
Inductive Automation Ignition RunQuery Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. …
CVE-2023-50220HIGHCVSS 8.8EG 8.8
2024-05-03
Inductive Automation Ignition Base64Element Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignit…
CVE-2023-50221HIGHCVSS 8.8EG 8.8
2024-05-03
Inductive Automation Ignition ResponseParser SerializedResponse Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Induct…
CVE-2023-50222HIGHCVSS 8.8EG 8.8
2024-05-03
Inductive Automation Ignition ResponseParser Notification Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Au…
CVE-2023-50223HIGHCVSS 8.8EG 8.9
2024-05-03
Inductive Automation Ignition ExtendedDocumentCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automati…
CVE-2023-50252CRITICALCVSS 9.8EG 9.8
2023-12-12
php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling `<use>` tag that references an `<image>` tag, it merges the attributes from the `<use>` tag to the `<image>` tag. The problem pops up especially …
CVE-2023-50943HIGHCVSS 7.5EG 7.5
2024-01-24
Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enable_xcom_pickling=False" configuration setting resulting in poisoned data after XCom de…
CVE-2023-51389CRITICALCVSS 9.8EG 9.8
2024-02-22
Hertzbeat is a real-time monitoring system. At the interface of `/define/yml`, SnakeYAML is used as a parser to parse yml content, but no security configuration is used, resulting in a YAML deserialization vulnerability. Version 1.4.1 fixe…
CVE-2023-51414CRITICALCVSS 9.8EG 9.8
2023-12-29
Deserialization of Untrusted Data vulnerability in EnvialoSimple EnvíaloSimple: Email Marketing y Newsletters.This issue affects EnvíaloSimple: Email Marketing y Newsletters: from n/a through 2.1.
CVE-2023-51422CRITICALCVSS 8.8EG 9.9
2023-12-29
Deserialization of Untrusted Data vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition.This issue affects Webinar Plugin: Create live/evergreen/automat…
CVE-2023-51470CRITICALCVSS 8.8EG 9.9
2023-12-29
Deserialization of Untrusted Data vulnerability in Jacques Malgrange Rencontre – Dating Site.This issue affects Rencontre – Dating Site: from n/a through 3.11.1.
CVE-2023-51505CRITICALCVSS 9.8EG 10.0
2023-12-29
Deserialization of Untrusted Data vulnerability in realmag777 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store.This issue affects Active Products Tables for WooCommerce. Professional products table…
CVE-2023-51518CRITICALCVSS 9.8EG 9.8
2024-02-27
Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that cou…
CVE-2023-51545CRITICALCVSS 8.8EG 9.6
2023-12-29
Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career – Manage job board listings, and recruitments.This issue affects Job Manager & Career – Manage job board listings, and…
CVE-2023-51570CRITICALCVSS 9.8EG 9.8
2024-04-01
Voltronic Power ViewPower Pro Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. Authentic…
CVE-2023-51576CRITICALCVSS 9.8EG 9.8
2024-05-03
Voltronic Power ViewPower Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower. Authentication is…
CVE-2023-51641CRITICALCVSS 6.3EG 9.8
2024-11-22
Allegra renderFieldMatch Deserialization of Unstrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required…

Map vulnerabilities like CWE-502 to your infrastructure

EchelonGraph correlates every CVE — across CWE-502 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →