CVE-2025-54366 FreeScout's deserialization of untrusted data leads to Remote Code Execution

FreeScout is a lightweight free open source help desk and shared inbox built with PHP Laravel framework. In versions 1.8.185 and below, there is a critical deserialization vulnerability in the /conversation/ajax endpoint that allows authenticated users with knowledge of the APPKEY to achieve remo...

CVE-2025-43489

A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could deserialize untrusted data without validation. HP has addressed the issue in the latest software update...

CVE-2025-30949 WordPress Site Chat on Telegram plugin <= 1.0.4 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in Guru Team Site Chat on Telegram site-chat-on-telegram allows Object Injection.This issue affects Site Chat on Telegram: from n/a through = 1.0.4...

CVE-2025-31422

Vulnerability: CVE-2025-31422 in designthemes Visual Art | Gallery WordPress Theme (

CVE-2025-31422 WordPress Visual Art | Gallery WordPress Theme <= 2.4 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in designthemes Visual Art | Gallery WordPress Theme visual-arts allows Object Injection.This issue affects Visual Art | Gallery WordPress Theme: from n/a through = 2.4...

PT-2025-29786 · Telegram · Site Chat On Telegram

Name of the Vulnerable Software and Affected Versions: Site Chat on Telegram versions n/a through 1.0.4 Description: A deserialization of untrusted data issue exists in Site Chat on Telegram, potentially allowing object injection. Recommendations: Update Site Chat on Telegram to a version later...

PT-2025-29777 · Nootheme · Nootheme Yogi

Name of the Vulnerable Software and Affected Versions: NooTheme Yogi versions through 2.9.0 Description: The software contains a deserialization of untrusted data flaw that allows for object injection. Recommendations: Update NooTheme Yogi to a version later than 2.9.0...

PT-2025-29681 · Unknown · Gpt-Sovits-Webui

Name of the Vulnerable Software and Affected Versions: GPT-SoVITS-WebUI versions 20250228v3 and prior Description: GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. A deserialization issue exists in the bsroformer.py file. The model choose variable accepts user-supplied input, such...

CVE-2025-7504 Friends 3.5.1 - Authenticated (Subscriber+) PHP Object Injection

The Friends plugin for WordPress is vulnerable to PHP Object Injection in version 3.5.1 via deserialization of untrusted input of the queryvars parameter This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is prese...

CVE-2025-47994

Deserialization of untrusted data in Microsoft Office allows an unauthorized attacker to elevate privileges locally...

USN-7630-1 resteasy, resteasy3.0 vulnerabilities

It was discovered that RESTEasy made insufficient use of random values in asynchronous jobs. An attacker could possibly use this issue to steal user data. This issue only affected Ubuntu 16.04 LTS. CVE-2016-6345 It was discovered that RESTEasy enabled a vulnerable GZIP decompression module by...

CVE-2025-27203

CVE-2025-27203 affects Adobe Connect 24.0 and earlier. Issue: Deserialization of untrusted data leading to arbitrary code execution. Exploitation requires user interaction and, per the sources, may change scope. Severity is high: CVSSv3.1 base score 9.6 (CRITICAL). Affected component is the deser...

CVE-2025-47994

Microsoft Office Elevation of Privilege (CVE-2025-47994) is caused by deserialization of untrusted data within Office components. The vulnerability allows local privilege escalation. Affected products include Office 2016 family components (Word, Excel, PowerPoint, SharePoint), with exploits linke...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in spring-web-5.3.26.jar

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of spring-web-5.3.26.jar Vulnerability Details CVEID:CVE-2016-1000027 DESCRIPTION: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution RCE issue if used for Java deserialization of untrusted...

Adobe Experience Manager 6.0.0.0.0.0 < 6.5.0.0.20250527.0 Arbitrary code execution (APSB25-67)

The version of Adobe Experience Manager installed on the remote host is prior to 6.5.0.0.20250527.0. It is, therefore, affected by a vulnerability as referenced in the APSB25-67 advisory. - Adobe Experience Manager MS versions 6.5.23.0 and earlier are affected by a Deserialization of Untrusted Da...

Apache Seata Deserialization Vulnerability

Apache Seata is the United States Apache Apache Foundation of a microservices architecture in the United States to provide high-performance and easy to use distributed transaction services in the open source project . A deserialization vulnerability exists in Apache Seata versions prior to 2.0.0 ...

CVE-2025-7099

BoyunCMS

CVE-2025-49417 WordPress WooCommerce Product Multi-Action plugin <= 1.3 - Deserialization of untrusted data Vulnerability

Deserialization of Untrusted Data vulnerability in BestWpDeveloper WooCommerce Product Multi-Action Woo-product-multiaction allows Object Injection.This issue affects WooCommerce Product Multi-Action: from n/a through = 1.3...

CVE-2024-13786

The education theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.10 via deserialization of untrusted input in the 'themerexcallbackviewmoreposts' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP...

CVE-2025-6464 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.44.2 via deserialization of untrusted input in the 'entrydeleteuploadfiles' function. This makes it possible for unauthenticat...