CVE-2024-10936 String Locator <= 2.6.6 - Unauthenticated PHP Object Injection

The String locator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.6 via deserialization of untrusted input in the 'recursiveunserializereplace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP...

CVE-2025-0465

The CVE-2025-0465 entry concerns AquilaCMS 1.412.13. An issue in the file /api/v2/categories arises from manipulating the argument PostBody.populate, causing deserialization. This is described as a remote attack with the exploit disclosed publicly. The vulnerability details come from multiple sou...

CVE-2025-0465 AquilaCMS categories deserialization

A vulnerability was found in AquilaCMS 1.412.13. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/v2/categories. The manipulation of the argument PostBody.populate leads to deserialization. The attack may be launched remotely. The exploit has be...

PT-2025-3560 · Msfm +1 · Msfm +1

Name of the Vulnerable Software and Affected Versions: MSFM versions prior to 2025.01.01 Description: The issue is related to a fastjson deserialization vulnerability in the component system/table/editField. This vulnerability was discovered in MSFM. Recommendations: For versions prior to...

PT-2025-3556 · Msfm · Msfm

Name of the Vulnerable Software and Affected Versions: MSFM versions prior to 2025.01.01 Description: The issue is related to a deserialization vulnerability that can be exploited via the pom.xml configuration file. This vulnerability was discovered in MSFM. Recommendations: For versions prior to...

PT-2025-3557 · Msfm +1 · Msfm +1

Name of the Vulnerable Software and Affected Versions: MSFM versions prior to 2025.01.01 Description: The issue is related to a fastjson deserialization vulnerability in the component system/table/addField. This vulnerability was discovered in MSFM. Recommendations: For versions prior to...

CVE-2024-57764

MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/add...

LangChain < 0.2.9 Vulnerability - CVE-2024-5998

The version of LangChain installed on the remote host is prior to 0.2.9. It is, therefore, affected by a deserialization vulnerability in the FAISS.deserializefrombytes function. This can lead to the execution of arbitrary commands via the os.system function. Note that Nessus has not tested for...

CVE-2024-13136

A vulnerability was found in wangl1989 mysiteforme 1.0 and classified as critical. Affected by this issue is the function rememberMeManager of the file src/main/java/com/mysiteforme/admin/config/ShiroConfig.java. The manipulation leads to deserialization. The attack may be launched remotely. The...

CVE-2024-56058 WordPress VRPConnector plugin <= 2.0.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in denniskravetstns VRPConnector vrpconnector allows Object Injection.This issue affects VRPConnector: from n/a through = 2.0.1...

PT-2024-36253 · Forumwp · Forumwp

Name of the Vulnerable Software and Affected Versions: ForumWP versions 2.1.0 and earlier Description: The issue is related to the deserialization of untrusted data, allowing object injection. This can potentially lead to security breaches. Recommendations: For versions 2.1.0 and earlier, update ...

PT-2024-17359 · Gfi · Gfi Archiver

Name of the Vulnerable Software and Affected Versions: GFI Archiver affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Authentication is required to exploit this issue. The specific flaw exists withi...

shared_preferences_android vulnerability

Impact Due to some data types not being natively representable for the available storage options, sharedpreferencesandroid serializes and deserializes special string prefixes to store these unrepresentable data types. This allows arbitrary classes to be deserialized leading to arbitrary code...

PT-2024-9308 · Drupal · Drupal Core

Name of the Vulnerable Software and Affected Versions: Drupal Core versions 8.0.0 through 10.2.10 Drupal Core versions 10.3.0 through 10.3.8 Drupal Core versions 11.0.0 through 11.0.7 Description: The issue is related to the deserialization of untrusted data, which allows object injection. This c...

BIT-ELK-2024-37285 Kibana arbitrary code execution via YAML deserialization

A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privileges...

CVE-2024-37285

A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privileges...

CVE-2024-37285 Kibana arbitrary code execution via YAML deserialization

A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privileges...

Elastic Kibana 代码问题漏洞

Elastic Kibana is an available data visualization dashboard software from Elastic. A code issue vulnerability exists in Elastic Kibana that stems from a deserialization issue that can be triggered by Kibana when it attempts to parse a YAML document that contains a carefully crafted payload. An...

Deserialization Vulnerability in Multiple Siemens Products

SIMATIC S7-PLCSIM simulates the S7-1200, S7-1500 and a number of other PLC derivatives shipped as part of SIMATIC STEP 7. simatic step7 TIA Portal is an engineering software package for configuring and programming SIMATIC controllers. simmocode ES is the simmocode ES is the core software package...

Remote Code Execution (RCE)

snipe/snipe-it is vulnerable to Remote Code Execution RCE. The vulnerability is due to the deserialization of untrusted data in the cookie-handling process, allows an attacker can execute arbitrary code on the server by exploiting the APPKEY, especially if it is set to a default value as found in...