CVE-2023-25135

vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verifyserialized checks that a value is serialized by calling unserialize and then checking for errors. The fixed versions a...

CVE-2023-3232

A vulnerability was found in Zhong Bang CRMEB up to 4.6.0 and classified as critical. This issue affects some unknown processing of the file /api/wechat/appauth of the component Image Upload. The manipulation leads to deserialization. The exploit has been disclosed to the public and may be used...

CVE-2022-31680

The vCenter Server contains an unsafe deserialisation vulnerability in the PSC Platform services controller. A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server...

PT-2025-22789 · Unknown · Pagaleve Pix

Name of the Vulnerable Software and Affected Versions: Pagaleve Pix 4x sem juros - Pagaleve versions 1.6.9 and earlier Description: The issue is related to Deserialization of Untrusted Data, allowing Object Injection. This enables potential exploitation by injecting malicious objects into the...

PT-2025-22688 · Designthemes · Designthemes Crafts & Arts

Name of the Vulnerable Software and Affected Versions: designthemes Crafts & Arts versions n/a through 2.5 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For designthemes Crafts & Arts versions n/a through 2.5, update to a...

WordPress plugin ZoomSounds 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

PT-2025-22772 · Unknown · Wc Affiliate

Name of the Vulnerable Software and Affected Versions: WC Affiliate versions n/a through 2.9.1 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This is a problem where an application deserializes data from an untrusted source, potentially...

PT-2025-22752 · Wpfunnels · Wpfunnels

Name of the Vulnerable Software and Affected Versions: WPFunnels versions 3.5.18 and earlier Description: The issue is related to Deserialization of Untrusted Data, allowing Object Injection in WPFunnels. Recommendations: For versions 3.5.18 and earlier, update to a version later than 3.5.18 to...

CVE-2022-44542

lesspipe before 2.06 allows attackers to execute code via Perl Storable pst files, because of deserialized object destructor execution via a key/value pair in a hash...

CVE-2022-29363

Phpok v6.1 was discovered to contain a deserialization vulnerability via the updatef function in logincontrol.php. This vulnerability allows attackers to getshell via writing arbitrary files...

CVE-2021-34992

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS 6.10. Authentication is required to exploit this vulnerability. The specific flaw exists within Composite.dll. The issue results from the lack of proper validation of user-supplied...

CVE-2021-36766

Concrete5 through 8.5.5 deserializes Untrusted Data. The vulnerable code is located within the controllers/singlepage/dashboard/system/environment/logging.php Logging::updatelogging method. User input passed through the logFile request parameter is not properly sanitized before being used in a ca...

CVE-2021-41588

In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects. The attacker must have the encryption and signing keys...

CVE-2021-36567

ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache...

CVE-2020-25259

An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It uses XML deserialization libraries in an unsafe manner...

CVE-2018-21234

Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set...

CVE-2018-11569

Controller/ListController.php in Eventum 3.5.0 is vulnerable to Deserialization of Untrusted Data. Fixed in version 3.5.2...

CVE-2018-20993

An issue was discovered in the yaml-rust crate before 0.4.1 for Rust. There is uncontrolled recursion during deserialization...

CVE-2019-12799

In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code...

CVE-2025-4905

A vulnerability was found in iop-apl-uw basestation3 up to 3.0.4 and classified as problematic. This issue affects the function loadqcpickl of the file basestation3/QC.py. The manipulation of the argument qcfile leads to deserialization. An attack has to be approached locally. The exploit has bee...