CVE-2025-48018 Deserialization of Untrusted Data

An authenticated user can modify application state data...

CVE-2025-39356 WordPress Foodbakery Sticky Cart plugin <= 3.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Chimpstudio Foodbakery Sticky Cart foodbakery-sticky-cart allows Object Injection.This issue affects Foodbakery Sticky Cart: from n/a through = 3.2...

PT-2025-22067 · WordPress · Quantumcloud Wpbot Pro

Name of the Vulnerable Software and Affected Versions: QuantumCloud WPBot Pro Wordpress Chatbot versions n/a through 12.7.0 Description: The issue is related to the deserialization of untrusted data, allowing object injection in the QuantumCloud WPBot Pro Wordpress Chatbot. This can be exploited...

CVE-2025-4701

A vulnerability, which was classified as problematic, has been found in VITA-MLLM Freeze-Omni up to 20250421. This issue affects the function torch.load of the file models/utils.py. The manipulation of the argument path leads to deserialization. It is possible to launch the attack on the local ho...

PT-2025-21731 · Shapedplugin Llc · Wp Tabs

Name of the Vulnerable Software and Affected Versions: ShapedPlugin LLC WP Tabs versions 2.2.11 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions 2.2.11 and earlier, update to a version that contains a...

PT-2025-21600 · Xu Yijie · Grpo-Flat

Name of the Vulnerable Software and Affected Versions: XU-YIJIE grpo-flat up to 9024b43f091e2eb9bac65802b120c0b35f9ba856 Description: A vulnerability has been found in the function main of the file grpo vanilla.py. The manipulation leads to deserialization. Local access is required to approach th...

CVE-2025-47784 Emlog vulnerable to Deserialization of Untrusted Data

Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nickname can cause strreplace to replace the value of nameorig with empty, causing deserialization to fail and return false. Commit...

CVE-2025-47784 Emlog vulnerable to Deserialization of Untrusted Data

Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nickname can cause strreplace to replace the value of nameorig with empty, causing deserialization to fail and return false. Commit...

PT-2025-21361 · Emlog · Emlog

Name of the Vulnerable Software and Affected Versions: Emlog versions 2.5.13 and earlier Description: Emlog is an open source website building system. The system has a deserialization issue. A user can create a carefully crafted nickname, causing str replace to replace the value of name orig with...

PT-2025-21231 · Medidok · Medidok

Name of the Vulnerable Software and Affected Versions: mediDOK versions prior to 2.5.18.43 Description: The issue allows remote attackers to achieve remote code execution on a target system via deserialization of untrusted data. Recommendations: For versions prior to 2.5.18.43, update to version...

Microsoft SharePoint Server Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally...

CVE-2025-30012

CVE-2025-30012 affects the SAP SRM Live Auction Cockpit component, where a deprecated Java applet enables an unauthenticated attacker to trigger deserialization of a crafted payload, leading to execution of arbitrary OS commands with SAP Administrator privileges. The cited impact is high on confi...

PT-2025-20994 · Microsoft · Office Sharepoint +1

Name of the Vulnerable Software and Affected Versions: Microsoft Office SharePoint affected versions not specified Description: The issue concerns the deserialization of untrusted data, allowing an unauthorized attacker to execute code locally. This enables remote attackers to execute arbitrary...

CVE-2025-47629 WordPress WP-CRM System plugin <= 3.4.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Object Injection.This issue affects WP-CRM System: from n/a through = 3.4.5...

CVE-2025-0855 PGS Core <= 5.8.0 - Unauthenticated PHP Object Injection

The PGS Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.8.0 via deserialization of untrusted input in the 'importheader' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in...

CVE-2025-34491

GFI MailEssentials prior to version 21.8 is vulnerable to a .NET deserialization issue. A remote and authenticated attacker can execute arbitrary code by sending crafted serialized .NET when joining to a Multi-Server setup...

PT-2025-18224 · Adobe · Acrobat

Name of the Vulnerable Software and Affected Versions: Adobe Acrobat affected versions not specified Description: The issue concerns a deserialization problem in Adobe Acrobat. No further details are available regarding the estimated number of potentially affected devices or real-world incidents...

CVE-2025-34491

GFI MailEssentials prior to version 21.8 is vulnerable to a .NET deserialization issue. A remote and authenticated attacker can execute arbitrary code by sending crafted serialized .NET when joining to a Multi-Server setup...

CVE-2023-35815

DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data...

CVE-2025-2105

The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserialization of untrusted input from the 'file' parameter of the 'ravendownloadfile' function. This makes it possible for attackers to inject a PHP Object through a PH...