CVE-2025-3108 Unsafe Deserialization in JsonPickleSerializer Enables Remote Code Execution in run-llama/llama_index

A critical deserialization vulnerability exists in the run-llama/llamaindex library's JsonPickleSerializer component, affecting versions v0.12.27 through v0.12.40. This vulnerability allows remote code execution due to an insecure fallback to Python's pickle module. JsonPickleSerializer prioritiz...

CVE-2025-3108

CVE-2025-3108 affects run-llama/llama_index, specifically the JsonPickleSerializer in versions v0.12.27–v0.12.40. The root cause is an insecure fallback to Python’s pickle during deserialization, enabling remote code execution if untrusted data is processed. The impact can be full system compromi...

Exploit for Missing Authentication for Critical Function in Oracle Weblogic_Server

weblogic-scan weblogic 漏洞扫描工具 妄想试图weblogic一把梭 目前检测的功能 - x console 页面探测 & 弱口令扫描 - x uuid页面的SSRF - x CVE-2017-10271 wls-wsat页面的反序列化 - x CVE-2018-2628 反序列化 - x CNVD-C-2019-48814 后期可以的话还会继续加功能的，主要是一些反序列化的poc真的不好写，我也不咋会.. USE 使用前请先填写config.py中的server参数...

BoyunCMS security vulnerabilities

BoyunCMS is an enterprise content management system from Boyun China. A security vulnerability exists in BoyunCMS 1.21 and earlier versions, which stems from a misuse of the parameter dbhost leading to deserialization...

CVE-2025-52828

Deserialization of Untrusted Data vulnerability in designthemes Red Art redart allows Object Injection.This issue affects Red Art: from n/a through = 3.8...

WordPress plugin WooCommerce Product Multi-Action code issue vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

Delta Electronics DTN Soft Code Execution Vulnerability (CNVD-2025-22959)

Delta Electronics DTN Soft is a temperature controller software from Delta Electronics China. A code execution vulnerability exists in Delta Electronics DTN due to deserialization of untrustworthy data. An attacker can exploit this vulnerability to execute arbitrary code on the system...

ASNA Assist and ASNA Registrar security vulnerabilities

ASNA Assist and ASNA Registrar are both products of ASNA Corporation.ASNA Assist is a software for managing authentication license keys.ASNA Registrar is a software for registering ASNA products. A security vulnerability exists in ASNA Assist and ASNA Registrar versions prior to 2025-03-31, which...

CVE-2024-13786

The education theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.10 via deserialization of untrusted input in the 'themerexcallbackviewmoreposts' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP...

CVE-2024-13786

CVE-2024-13786 affects the WordPress Education Center theme (

WordPress plugin Forminator Forms has a vulnerability

WordPress Forminator Forms is a powerful free form builder plugin that supports the creation of many types of interactive forms. WordPress Forminator Forms suffers from a code issue vulnerability that stems from deserializing untrusted inputs in the function entrydeleteuploadfiles, which can be...

Deserialization Of Untrusted Data

org.apache.seata, seata-config-core is vulnerable to Deserialization of untrusted data. The vulnerability is due to insecure handling of serialized input, which allows attackers to exploit the system by sending maliciously crafted data...

Gladinet CentreStack < 16.4.10315.56368 Hard-coded Cryptographic Key

Gladinet CentreStack through 16.1.10296.56315 fixed in 16.4.10315.56368 has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors who know the machineKey to serialize a payload for server-side...

CVE-2025-32897

Deserialization of Untrusted Data vulnerability in Apache Seata incubating. This security vulnerability is the same as CVE-2024-47552, but the version range described in the CVE-2024-47552 definition is too narrow. This issue affects Apache Seata incubating: from 2.0.0 before 2.3.0. Severity...

CVE-2025-53416 File Parsing Deserialization of Untrusted Data in DTN Soft

Delta Electronics DTN Soft Project File Parsing Deserialization of Untrusted Data Remote Code Execution...

Delta Electronics DTM security vulnerability

Delta Electronics DTN Soft is a temperature controller software from Delta Electronics China. A code execution vulnerability exists in Delta Electronics DTN due to deserialization of untrustworthy data. An attacker can exploit this vulnerability to execute arbitrary code on the system...

CVE-2025-52725

Deserialization of Untrusted Data vulnerability in pebas CouponXxL couponxxl allows Object Injection.This issue affects CouponXxL: from n/a through = 3.0.0...

CVE-2025-52709

Deserialization of Untrusted Data vulnerability in wpeverest Everest Forms allows Object Injection. This issue affects Everest Forms: from n/a through 3.2.2...

GHSA-M964-FJRH-XXQ2 Apache Seata Vulnerable to Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Apache Seata incubating. This security vulnerability is the same as CVE-2024-47552, but the version range described in the CVE-2024-47552 definition is too narrow. This issue affects Apache Seata incubating: from 2.0.0 before 2.3.0. The Apache...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to improper input sanitization. An attacker can execute arbitrary code by submitting specially crafted serialized data. Details Serialization is a process of converting an object into a sequence of...