CVE-2025-24447 ColdFusion | Deserialization of Untrusted Data (CWE-502)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user resulting in a High impact to Confidentiality and Integrity. Exploitation of this issue does...

CVE-2025-3165

A vulnerability classified as critical has been found in thu-pacman chitu 0.1.0. This affects the function torch.load of the file chitu/chitu/backend.py. The manipulation of the argument ckptpath/quantckptdir leads to deserialization. An attack has to be approached locally...

CVE-2025-2244 Insecure PHP deserialization issue in GravityZone Console (VA-12634)

A vulnerability in the sendMailFromRemoteSource method in Emails.php as used in Bitdefender GravityZone Console unsafely uses php unserialize on user-supplied input without validation. By crafting a malicious serialized payload, an attacker can trigger PHP object injection, perform a file write,...

CVE-2025-3162

A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been classified as critical. Affected is the function loadweightckpt of the file lmdeploy/lmdeploy/vl/model/utils.py of the component PT File Handler. The manipulation leads to deserialization. Attacking locally is a requirement...

CVE-2025-3162 InternLM LMDeploy PT File utils.py load_weight_ckpt deserialization

A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been classified as critical. Affected is the function loadweightckpt of the file lmdeploy/lmdeploy/vl/model/utils.py of the component PT File Handler. The manipulation leads to deserialization. Attacking locally is a requirement...

Chitu 代码问题漏洞

Chitu is thu-pacman open source a high performance reasoning framework for large language models. A code issue vulnerability exists in Chitu version 0.1.0, which stems from the fact that incorrect manipulation of the parameter ckptpath/quantckptdir can lead to deserialization issues...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to arbitrary code execution in Hugging Face Transformers [CVE-2024-11392, CVE-2024-11393, CVE-2024-11394]

Summary IBM Watson Speech Services Cartridge is vulnerable to arbitrary code execution in Hugging Face Transformers, caused by a flaw in the parsing of model files CVE-2024-11392, CVE-2024-11393, CVE-2024-11394. Hugging Face Transformers is used by our Speech runtimes. This vulnerabilitiy has bee...

CVE-2024-39780

A YAML deserialization vulnerability was found in the Robot Operating System ROS 'dynparam', a command-line tool for getting, setting, and deleting parameters of a dynamically configurable node, affecting ROS distributions Noetic and earlier. The issue is caused by the use of the yaml.load functi...

CVE-2025-30892

WpTravelly (WordPress Tour & Travel Booking Plugin) has a Deserialization of Untrusted Data vulnerability enabling PHP Object Injection in versions up to 1.8.7. The vulnerability has a high overall impact (CVSS 3.1: 8.8) affecting confidentiality, integrity, and availability. The issue is labeled...

PT-2025-14075 · Unknown · Mdjm Event Management

Name of the Vulnerable Software and Affected Versions: MDJM Event Management versions 1.7.5.2 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection in MDJM Event Management. Recommendations: For MDJM Event Management versions 1.7.5.2 and...

PT-2025-14076 · Unknown · Sunshine Photo Cart

Name of the Vulnerable Software and Affected Versions: Sunshine Photo Cart versions 3.4.10 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This can potentially be exploited, but no specific details about the estimated number of...

CVE-2025-31129 jooby-pac4j: deserialization of untrusted data

Jooby is a web framework for Java and Kotlin. The pac4j io.jooby.internal.pac4j.SessionStoreImplget module deserializes untrusted data. This vulnerability is fixed in 2.17.0 2.x and 3.7.0 3.x...

PT-2025-13441 · Unknown · A-Blog Cms

Name of the Vulnerable Software and Affected Versions: a-blog cms affected versions not specified Description: A critical issue exists due to the deserialization of untrusted data in a-blog cms, allowing an attacker to store arbitrary files on the server. This can lead to the execution of arbitra...

CVE-2025-2332

CVE-2025-2332 affects the WordPress plugin Export All Posts, Products, Orders, Refunds & Users. It allows unauthenticated PHP Object Injection via deserialization in returnMetaValueAsCustomerInput, with impact only if a POP chain exists in a second plugin/theme. Affected versions go up to 2.13; p...

CVE-2025-2332 Export All Posts, Products, Orders, Refunds & Users <= 2.13 - Unauthenticated PHP Object Injection

The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.13 via deserialization of untrusted input in the 'returnMetaValueAsCustomerInput' function. This makes it possible for unauthenticated attacke...

PT-2025-13059 · Cozmoslabs · Cozmoslabs Translatepress

Name of the Vulnerable Software and Affected Versions: Cozmoslabs TranslatePress versions 2.9.6 and earlier Description: The issue is related to the deserialization of untrusted data, which allows object injection. This is a problem that affects the functionality of the software, potentially...

CVE-2024-13889

The WordPress Importer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.8.3 via deserialization of untrusted input in the 'maybeunserialize' function. This makes it possible for authenticated attackers, with Administrator-level access and above, t...

CVE-2024-13889

CVE-2024-13889 affects WordPress Importer (WordPress Importer plugin) up to version 0.8.3 via PHP Object Injection in maybe_unserialize. Exploitation requires Administrator+ access and, crucially, a POP chain present from another plugin/theme; without a POP chain, impact is limited. The vulnerabi...

CVE-2025-2690

A vulnerability, which was classified as critical, was found in yiisoft Yii2 up to 2.0.39. This affects the function Generate of the file phpunit\src\Framework\MockObject\MockClass.php. The manipulation leads to deserialization. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-29310

An issue in onos v2.7.0 allows attackers to trigger a packet deserialization problem when supplying a crafted LLDP packet. This vulnerability allows attackers to execute arbitrary commands or access network information...