5573 matches found
Mescius ActiveReports.NET 代码问题漏洞
Mescius ActiveReports.NET is a .NET reporting tool from Mescius Japan. A code issue vulnerability exists in Mescius ActiveReports.NET that stems from the TypeResolutionService class not properly validating user-supplied data, which could lead to deserialization attacks and remote code execution...
Deserialization of Untrusted Data
Overview llama-index is an Interface between LLMs and your data Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JsonPickleSerializer process. An attacker can execute arbitrary code by submitting specially crafted serialized data that triggers the...
CVE-2025-7099 BoyunCMS Installation install2.php deserialization
A vulnerability has been found in BoyunCMS up to 1.21 on PHP7 and classified as critical. Affected by this vulnerability is an unknown functionality of the file install/install2.php of the component Installation Handler. The manipulation of the argument dbhost leads to deserialization. The attack...
CVE-2025-3108
CVE-2025-3108 affects run-llama/llama_index, specifically the JsonPickleSerializer in versions v0.12.27–v0.12.40. The root cause is an insecure fallback to Python’s pickle during deserialization, enabling remote code execution if untrusted data is processed. The impact can be full system compromi...
CVE-2025-3108 Unsafe Deserialization in JsonPickleSerializer Enables Remote Code Execution in run-llama/llama_index
A critical deserialization vulnerability exists in the run-llama/llamaindex library's JsonPickleSerializer component, affecting versions v0.12.27 through v0.12.40. This vulnerability allows remote code execution due to an insecure fallback to Python's pickle module. JsonPickleSerializer prioritiz...
Exploit for Missing Authentication for Critical Function in Oracle Weblogic_Server
weblogic-scan weblogic 漏洞扫描工具 妄想试图weblogic一把梭 目前检测的功能 - x console 页面探测 & 弱口令扫描 - x uuid页面的SSRF - x CVE-2017-10271 wls-wsat页面的反序列化 - x CVE-2018-2628 反序列化 - x CNVD-C-2019-48814 后期可以的话还会继续加功能的，主要是一些反序列化的poc真的不好写，我也不咋会.. USE 使用前请先填写config.py中的server参数...
BoyunCMS 安全漏洞
BoyunCMS is an enterprise content management system from Boyun China. A security vulnerability exists in BoyunCMS 1.21 and earlier versions, which stems from a misuse of the parameter dbhost leading to deserialization...
CVE-2025-52828
Deserialization of Untrusted Data vulnerability in designthemes Red Art redart allows Object Injection.This issue affects Red Art: from n/a through = 3.8...
WordPress plugin WooCommerce Product Multi-Action 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...
Delta Electronics DTN Soft Code Execution Vulnerability (CNVD-2025-22959)
Delta Electronics DTN Soft is a temperature controller software from Delta Electronics China. A code execution vulnerability exists in Delta Electronics DTN due to deserialization of untrustworthy data. An attacker can exploit this vulnerability to execute arbitrary code on the system...
ASNA Assist和ASNA Registrar 安全漏洞
ASNA Assist and ASNA Registrar are both products of ASNA Corporation.ASNA Assist is a software for managing authentication license keys.ASNA Registrar is a software for registering ASNA products. A security vulnerability exists in ASNA Assist and ASNA Registrar versions prior to 2025-03-31, which...
CVE-2024-13786
The education theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.10 via deserialization of untrusted input in the 'themerexcallbackviewmoreposts' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP...
CVE-2024-13786
CVE-2024-13786 affects the WordPress Education Center theme (
WordPress plugin Forminator Forms 问题漏洞
WordPress Forminator Forms is a powerful free form builder plugin that supports the creation of many types of interactive forms. WordPress Forminator Forms suffers from a code issue vulnerability that stems from deserializing untrusted inputs in the function entrydeleteuploadfiles, which can be...
Deserialization Of Untrusted Data
org.apache.seata, seata-config-core is vulnerable to Deserialization of untrusted data. The vulnerability is due to insecure handling of serialized input, which allows attackers to exploit the system by sending maliciously crafted data...
Gladinet CentreStack < 16.4.10315.56368 Hard-coded Cryptographic Key
Gladinet CentreStack through 16.1.10296.56315 fixed in 16.4.10315.56368 has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors who know the machineKey to serialize a payload for server-side...
CVE-2025-32897
Deserialization of Untrusted Data vulnerability in Apache Seata incubating. This security vulnerability is the same as CVE-2024-47552, but the version range described in the CVE-2024-47552 definition is too narrow. This issue affects Apache Seata incubating: from 2.0.0 before 2.3.0. Severity...
CVE-2025-53416 File Parsing Deserialization of Untrusted Data in DTN Soft
Delta Electronics DTN Soft Project File Parsing Deserialization of Untrusted Data Remote Code Execution...
Delta Electronics DTM 安全漏洞
Delta Electronics DTN Soft is a temperature controller software from Delta Electronics China. A code execution vulnerability exists in Delta Electronics DTN due to deserialization of untrustworthy data. An attacker can exploit this vulnerability to execute arbitrary code on the system...