CVE-2022-45134

Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 deserializes user input unsafely during skin import. A particularly structured XML file could cause code execution when being processed...

WordPress PDF for WPForms plugin <= 6.5.0 - Deserialization of untrusted data vulnerability

Deserialization of untrusted data vulnerability discovered by Phat RiO in WordPress Plugin PDF for WPForms versions = 6.5.0...

WordPress PDF Invoice Builder for WooCommerce plugin <= 6.5.0 - Deserialization of untrusted data vulnerability

Deserialization of untrusted data vulnerability discovered by Phat RiO in WordPress Plugin PDF Invoice Builder for WooCommerce versions = 6.5.0...

CVE-2025-52287

OperaMasks SDK ELite Script Engine v0.5.0 was discovered to contain a deserialization vulnerability...

CVE-2025-52287

OperaMasks SDK ELite Script Engine v0.5.0 was discovered to contain a deserialization vulnerability...

Exploit for Deserialization of Untrusted Data in Lfprojects Mlflow

| / || |...

CVE-2025-54053

Deserialization of Untrusted Data vulnerability in Adrian Tobey Groundhogg groundhogg allows Object Injection.This issue affects Groundhogg: from n/a through = 4.2.2...

CVE-2025-49438

Deserialization of Untrusted Data vulnerability in Max Chirkov Simple Login Log allows Object Injection. This issue affects Simple Login Log: from n/a through 1.1.3...

CVE-2025-54014

Deserialization of Untrusted Data vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Object Injection.This issue affects MediCenter - Health Medical Clinic: from n/a through = 15.1...

CVE-2025-54012

Deserialization of Untrusted Data vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Object Injection.This issue affects Welcart e-Commerce: from n/a through = 2.11.16...

CVE-2025-54007

Deserialization of Untrusted Data vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Object Injection.This issue affects Post Grid and Gutenberg Blocks: from n/a through = 2.3.11...

CVE-2025-53560

Deserialization of Untrusted Data vulnerability in rascals Noisa noisa allows Object Injection.This issue affects Noisa: from n/a through = 2.6.0...

CVE-2025-8289

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the deleteassociatedfiles function. This makes it possible for unauthenticated attackers to inject a PHP Object. This...

CVE-2025-8145

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the getleadfields function. This makes it possible for unauthenticated attackers to inject a PHP Object. The addition...

CVE-2025-52287

The OperaMasks SDK ELite Script Engine version 0.5.0 is vulnerable to a deserialization vulnerability (CWE-502). This flaw allows for potential exploitation due to the insecure handling of untrusted data. The impact is rated as HIGH , with the potential for significant impacts on confidentiality,...

CVE-2025-52287

OperaMasks SDK ELite Script Engine v0.5.0 was discovered to contain a deserialization vulnerability...

CVE-2025-52287

OperaMasks SDK ELite Script Engine v0.5.0 was discovered to contain a deserialization vulnerability...

Security Bulletin: Multiple vulnerabilities in IBM Semeru Runtime affect Rational Business Developer

Summary There are multiple vulnerabilities in IBM Semeru Runtime used by Rational Business Developer. Rational Business Developer has provided fixes for the applicable CVEs. These issues were disclosed as part of the IBM Semeru Runtime Quarterly CPU - Oct 2024 - Includes OpenJDK July 2024 CPU plu...

CVE-2025-50461

A deserialization vulnerability exists in Volcengine's verl 3.0.0, specifically in the scripts/modelmerger.py script when using the "fsdp" backend. The script calls torch.load with weightsonly=False on user-supplied .pt files, allowing attackers to execute arbitrary code if a maliciously crafted...

CVE-2025-54053

Deserialization of Untrusted Data vulnerability in Adrian Tobey Groundhogg groundhogg allows Object Injection.This issue affects Groundhogg: from n/a through = 4.2.2...