5590 matches found
About Remote Code Execution – Microsoft SharePoint “ToolShell” (CVE-2025-49704) vulnerability
About Remote Code Execution - Microsoft SharePoint "ToolShell" CVE-2025-49704 vulnerability. This vulnerability is from the Microsoft's July Patch Tuesday. SharePoint is a web application developed by Microsoft for corporate intranet portals, document management, and collaborative work...
CVE-2025-12844 AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization
The AI Engine plugin for WordPress is vulnerable to PHP Object Injection via PHAR Deserialization in all versions up to, and including, 3.1.8 via deserialization of untrusted input in the 'restsimpleTranscribeAudio' and 'restsimpleVisionQuery' functions. This makes it possible for authenticated...
CVE-2025-12844
CVE-2025-12844 affects the WordPress plugin AI Engine (versions up to and including 3.1.8). It describes a PHP Object Injection via PHAR Deserialization in rest_simpleTranscribeAudio and rest_simpleVisionQuery. Impact is limited unless a PHP Object Injection (POP) chain exists in another plugin/t...
EUVD-2025-131912
The N-central Software Probe 2025.4 is vulnerable to Remote Code Execution via deserialization...
CVE-2025-11367
The N-central Software Probe 2025.4 is vulnerable to Remote Code Execution via deserialization...
CVE-2025-11367
The CVE-2025-11367 entry affects the N-central Software Probe (windows) prior to version 2025.4. The vulnerability relies on deserialization, allowing remote code execution with network access and no authentication. Impact is described as full compromise of affected systems (high confidentiality,...
PT-2025-46499
Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Deserialization of untrusted data in Microsoft Office SharePoint can allow an authorized attacker to execute code over a network. Recommendations At the moment, there is n...
EUVD-2025-50782
ktg-mes before commit a484f96 2025-07-03 has a fastjson deserialization vulnerability. This is because it uses a vulnerable version of fastjson and deserializes unsafe input data...
CVE-2025-63617
ktg-mes before commit a484f96 2025-07-03 has a fastjson deserialization vulnerability. This is because it uses a vulnerable version of fastjson and deserializes unsafe input data...
Deserialization Of Untrusted Data
mllogger is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to manipulation of the loghandler argument data in mllogger/server.py, which triggers unsafe deserialization and allows a remote attacker to supply crafted input that can lead to arbitrary code execution or othe...
CVE-2025-63617
ktg-mes before commit a484f96 2025-07-03 has a fastjson deserialization vulnerability. This is because it uses a vulnerable version of fastjson and deserializes unsafe input data...
CVE-2025-63617
ktg-mes before commit a484f96 2025-07-03 has a fastjson deserialization vulnerability. This is because it uses a vulnerable version of fastjson and deserializes unsafe input data...
Security Bulletin: Multiple security vulnerabilities in Java may affect IBM Robotic Process Automation
Summary Multiple security vulnerabilities in Java affect IBM Robotic Process Automation. Java is used by IBM Robotic Process Automation as part of metrics and licening, and UMS. This bulletin identifies the fixes required to address these vulnerabilities. Vulnerability Details CVEID:CVE-2025-3076...
CVE-2025-12099 Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses'
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.8 via deserialization of untrusted input in the 'importallcourses' function. This makes it possible for authenticated...
PT-2025-45559
Name of the Vulnerable Software and Affected Versions Academy LMS – WordPress LMS Plugin for Complete eLearning Solution versions prior to 3.3.9 Description The software is susceptible to a PHP Object Injection due to deserialization of untrusted input within the import all courses function. This...
WordPress plugin Academy LMS – WordPress LMS Plugin for Complete eLearning Solution 代码问题漏洞
WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress is a blogging platform developed using the PHP language, with the ability to host personal blog sites on PHP and MySQL based servers.WordPress...
CVE-2025-64439
LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. In versions 2.1.2 and below, the JsonPlusSerializer used as the default serialization protocol for all checkpointing contains a Remote Code Execution RCE...
Deserialization of Untrusted Data
Overview pdfminer.six is a PDF parser and analyzer Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the CMapDB.loaddata function. An attacker can execute arbitrary code by crafting a malicious PDF that references a specially crafted pickle file, which is...
