MTW CleanShot X deserialization injection vulnerability

MTW CleanShot versions prior to 4.0.0 through 4.5.2, 4.6.0 through 4.6.3, 4.7.0 through 4.7.8, and 4.8.0 through 4.8.10 contain a deserialization injection vulnerability. This vulnerability stems from unsafe deserialization of untrusted data embedded in .cleanshot project files. It may allow...

Roundcube Webmail Project Roundcube Webmail deserialization injection vulnerability

The Roundcube Webmail project contains a deserialization injection vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability stems from improper handling of session keys prefixed with “!” by the rcubesession::unserialize function; as a result, subsequent session dat...

PHPOffice PHPPresentation deserialization injection vulnerability

PHPOffice PHPPresentation versions 1.2.0 and earlier contain a deserialization injection vulnerability. This vulnerability stems from unsafe deserialization practices; attackers can exploit it by uploading a ZIP file containing PhpPresentation.xml and passing it to the unserialize function via...

GS Plugins GS Pins for Pinterest deserialization injection vulnerability

GS Plugins GS Pins for Pinterest versions 1.9.2 and earlier contain a deserialization injection vulnerability. This vulnerability stems from improper handling of untrusted data during deserialization, potentially leading to object injection...

GS Plugins GS Pinterest Portfolio deserialization injection vulnerability

GS Plugins GS Pinterest Portfolio versions 2.8.2 and earlier contain a deserialization injection vulnerability. This vulnerability stems from the deserialization of untrusted data, potentially leading to object injection...

DokuWiki.org DokuWiki deserialization injection vulnerability

DokuWiki.org: Versions prior to DokuWiki 2026-07-14c contained a deserialization injection vulnerability. This vulnerability stemmed from the use of Draft::getDraftText, which passed the content of the draft file to unserialize, without restricting the classes allowed. Authentication users with...

Apache Camel deserialization injection vulnerability

Versions of Apache Camel Camel-Jgroups 4.0.0 to 4.18.5 and 4.19.0 to 4.22.1 contain a deserialization injection vulnerability. This vulnerability stems from the deserialization of untrusted data. The JGroupsEndpoint.createExchangeMessage method does not apply the java.io.ObjectInputFilter; instea...

IBM MQ Operator deserialization injection vulnerability

IBM MQ Operator versions 2.0.0 through 2.0.29, 3.2.0 through 3.2.29, 3.3.0 through 3.4.0 pre-versions, 3.4.1, 3.5.0 through 3.5.3, 3.6.0 through 3.6.4, 3.7.0 through 3.7.2, 3.8.0, 3.8.1, 3.9.0, 3.9.1, 3.9.2, and 4.0.0 through 4.0.4 have a deserialization injection vulnerability. This vulnerabilit...

IBM MQ deserialization injection vulnerability

IBM MQ has a deserialization injection vulnerability. This vulnerability arises from authenticated attackers sending specially crafted asynchronous consumption requests, which can cause the queue manager proxy process to crash, potentially leading to a denial-of-service attack...

IBM MQ Operator deserialization injection vulnerability

IBM MQ Operator versions 2.0.0 through 2.0.29, 3.2.0 through 3.2.29, 3.3.0 through 3.4.0 excluding versions prior to 3.4.1, 3.4.1, 3.5.0 through 3.5.3, 3.6.0 through 3.6.4, 3.7.0 through 3.7.2, 3.8.0 through 3.8.1, 3.9.0 through 3.9.2, and 4.0.0 through 4.0.4 have a deserialization injection...

Apache Camel deserialization injection vulnerability

Versions of Apache Camel from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a deserialization injection vulnerability. This vulnerability stems from a lack of application of the JavaSerializationFilterConfig in certain configuration paths of the camel-hazelcast component. As a result, Java...

WordPress Quiz and Survey Master has a deserialization injection vulnerability.

WordPress Quiz and Survey Master versions 11.2.7 and earlier have a deserialization injection vulnerability. This vulnerability stems from improper handling of deserialized untrusted data, which may lead to object injection attacks...

Mindee docTR deserialization injection vulnerability

Mindee docTR 1.1.0 and earlier versions have a deserialization injection vulnerability. This vulnerability stems from the use of torch.load to load checkpoints in loadpretrainedparams, where weightsonly=True is not set. This allows attackers to inject malicious pickle payloads by controlling loca...

ThimPress LearnPress deserialization injection vulnerability

ThimPress and LearnPress versions 4.4.10 and earlier have a deserialization injection vulnerability. This vulnerability stems from improper deserialization handling of the 'checkout-email' request parameter during the checkout AJAX operation. The deserialization process does not filter the syntax...

WordPress Kirki deserialization injection vulnerability

WordPress Kirki versions 6.3.2 and earlier have a deserialization injection vulnerability. This vulnerability arises from insufficient validation during the deserialization of untrusted inputs, allowing PHP object injection. Certified attackers can inject PHP objects into the system. If a POP cha...

Apache Kylin deserialization injection vulnerability

Versions 4 through 5.0.4 of Apache Kylin contain a deserialization injection vulnerability. This vulnerability arises because corrupted external cache services may lead to unsafe Java deserialization, resulting in the deserialization of untrusted data...

WordPress Sunshine Photo Cart deserialization injection vulnerability

WordPress Sunshine Photo Cart versions 3.7.4 and earlier have a deserialization injection vulnerability. This vulnerability stems from deserializing untrusted inputs, allowing unauthorized attackers to inject PHP objects. If a POP chain is present, it may delete arbitrary files, retrieve sensitiv...

Gravity Forms deserialization injection vulnerability

Versions of Gravity Forms prior to 3.1.1 have a deserialization injection vulnerability. This vulnerability stems from deserializing untrusted data, which may lead to object injection...

10up Distributor deserialization injection vulnerability

The 10up Distributor versions prior to 2.3.2 have a deserialization injection vulnerability. This vulnerability stems from the setmeta function in includes/utils.php, which performs double deserialization of distributed article metadata. This may allow users at the Contributor level to instantiat...

Lenovo Legion Zone Application deserialization injection vulnerability

Versions of the Lenovo Legion Zone Application prior to version 2.0.28.8182 contain a deserialization injection vulnerability. This vulnerability allows attackers to execute arbitrary code using the same logical network...