CVE-2025-39480

CVE-2025-39480 describes a Deserialization of Untrusted Data vulnerability (PHP Object Injection) in ThemeMakers Car Dealer (WordPress theme) affected versions through 1.6.6. The issue enables object injection on unauthenticated access, with attacker‑controlled data potentially compromising confi...

CVE-2025-39499

CVE-2025-39499 describes a deserialization of untrusted data in the BoldThemes Medicare WordPress theme (versions n/a–2.1.0), enabling PHP Object Injection. Public sources across multiple feeds confirm unauthenticated access and a critical impact (CVSS 9.8) with potential total compromise tied to...

CVE-2025-39499 WordPress Medicare Theme <= 2.1.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in BoldThemes Medicare allows Object Injection.This issue affects Medicare: from n/a through 2.1.0...

CVE-2025-47532

CVE-2025-47532 is a deserialization of untrusted data vulnerability in the WordPress CoinPayments.net Payment Gateway for WooCommerce. Affected software: CoinPayments.net Payment Gateway for WooCommerce up to and including version 1.0.17. Root cause: PHP object injection via deserialization of un...

CVE-2025-47568

The CVE-2025-47568 refers to a Deserialization of Untrusted Data vulnerability in the ZoomSounds WordPress plugin (ZoomSounds

CVE-2025-47568 WordPress ZoomSounds plugin <= 6.91 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ZoomIt ZoomSounds allows Object Injection. This issue affects ZoomSounds: from n/a through 6.91...

CVE-2025-47660 WordPress WC Affiliate plugin <= 2.16 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Codexpert, Inc WC Affiliate wc-affiliate allows Object Injection.This issue affects WC Affiliate: from n/a through = 2.16...

CVE-2025-48287 WordPress Pix 4x sem juros - Pagaleve <= 1.6.9 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in Pagaleve Pix 4x sem juros - Pagaleve allows Object Injection.This issue affects Pix 4x sem juros - Pagaleve: from n/a through 1.6.9...

CVE-2024-52338

Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example, user-supplied input files. This...

CVE-2024-6564

Buffer overflow in "rcardevinit" due to using due to using untrusted data rcarimagenumber as a loop counter before verifying it against RCARMAXBL3XIMAGE. This could lead to a full bypass of secure boot...

CVE-2024-3568

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the loadrepocheckpoint function of the TFPreTrainedModel class. Attackers can execute arbitrary code and commands by crafting a malicious serialized payload, exploiting...

CVE-2024-30221

Deserialization of Untrusted Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through = 3.1.1...

CVE-2024-23759

Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBookEntry" function...

CVE-2024-32733

Due to missing input validation and output encoding of untrusted data, SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject malicious JavaScript code into the dynamically crafted web page. On successful exploitation the attacker can access or modify...

CVE-2024-32817

Deserialization of Untrusted Data vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Import and export users and customers: from n/a through = 1.26.2...

CVE-2024-27985

Deserialization of Untrusted Data vulnerability in PropertyHive.This issue affects PropertyHive: from n/a through 2.0.9...

CVE-2024-22399

Deserialization of Untrusted Data vulnerability in Apache Seata. When developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests by directly sending bytecode based on the Seata private...

CVE-2023-52202

Deserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 MP3 Player with Folder Feedburner Playlist Free.This issue affects HTML5 MP3 Player with Folder Feedburner Playlist Free: from n/a through 2.8.0...

CVE-2023-34382

Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: from n/a through 3.7.19...

CVE-2023-52225

Deserialization of Untrusted Data vulnerability in Tagbox Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics.This issue affects Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: from n/a through 3.1...