CVE-2024-46983

sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blackli...

CVE-2024-31277

Deserialization of Untrusted Data vulnerability in PickPlugins Product Designer.This issue affects Product Designer: from n/a through 1.0.32...

CVE-2024-4471

The 140+ Widgets | Best Addons For Elementor – FREE for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.3.1 via deserialization of untrusted input in the 'exportcontent' function. This allows authenticated attackers, with contributor-level permissions and...

CVE-2024-13742

The iControlWP – Multiple WordPress Site Manager plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.4.5 via deserialization of untrusted input from the reqpars parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. N...

CVE-2024-22309

Deserialization of Untrusted Data vulnerability in QuantumCloud ChatBot with AI.This issue affects ChatBot with AI: from n/a through 5.1.0...

CVE-2024-40711

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution RCE...

CVE-2024-48033

Deserialization of Untrusted Data vulnerability in baptiste.gourdin Talkback talkback-secure-linkback-protocol allows Object Injection.This issue affects Talkback: from n/a through = 1.0...

CVE-2024-53673

A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code...

CVE-2025-0974 MaxD Lightning Module deserialization

A vulnerability was determined in MaxD Lightning Module 4.43/4.44 on OpenCart. This issue affects some unknown processing. Executing a manipulation of the argument liop/md can lead to deserialization. The attack may be launched remotely. The attack requires a high level of complexity. The...

PT-2025-4120 · Unknown +1 · Maxd Lightning Module +1

Name of the Vulnerable Software and Affected Versions: MaxD Lightning Module version 4.43 on OpenCart Description: A critical issue has been found in the MaxD Lightning Module on OpenCart, affecting some unknown processing. The manipulation of the argument li op/md leads to deserialization. The...

WordPress plugin Taxi Booking Manager for WooCommerce 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in the...

OpenCart Lightning 代码问题漏洞

OpenCart Lightning is an OpenCart extension from OpenCart, Inc. A code issue vulnerability exists in OpenCart Lightning version 4.43 that stems from a deserialization issue with the parameter liop/md...

Exploit for Deserialization of Untrusted Data in Themekraft Buddyforms

Exploit BuddyForms CVE-2023-26326 using Iconv CVE-2024-2961...

PT-2025-2262 · WordPress · Icontrolwp

Name of the Vulnerable Software and Affected Versions: iControlWP – Multiple WordPress Site Manager plugin for WordPress versions up to, and including, 4.4.5 Description: The issue is related to PHP Object Injection via deserialization of untrusted input from the reqpars parameter. This allows...

Deserialization of Untrusted Data

Overview snowflake-connector-python is a Snowflake Connector for Python Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the insecure handling of serialization exceptions which is not supported for all exceptions. This is because The OCSP response cache...

CVE-2025-0734 y_project RuoYi Whitelist getBeanName deserialization

A vulnerability has been found in yproject RuoYi up to 4.8.0 and classified as critical. This vulnerability affects the function getBeanName of the component Whitelist. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public an...

CVE-2025-24671

Deserialization of Untrusted Data vulnerability in Pdfcrowd Dev Team Save as PDF save-as-pdf-by-pdfcrowd allows Object Injection.This issue affects Save as PDF: from n/a through = 4.4.0...

CVE-2025-24671 WordPress Save as PDF Plugin by Pdfcrowd Plugin <= 4.4.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Pdfcrowd Dev Team Save as PDF save-as-pdf-by-pdfcrowd allows Object Injection.This issue affects Save as PDF: from n/a through = 4.4.0...

CVE-2025-24601

Deserialization of Untrusted Data vulnerability in ThimPress FundPress fundpress allows Object Injection.This issue affects FundPress: from n/a through = 2.0.6...

CVE-2025-24601

CVE-2025-24601 describes a deserialization of untrusted data vulnerability in the WordPress plugin FundPress (affected: versions up to and including 2.0.6). The underlying issue enables PHP object injection via deserialization, with a CVSSv3.1 base score of 9.8 (critical) and network attack vecto...