PT-2025-22090 · Themegoods · Themegoods Altair

Name of the Vulnerable Software and Affected Versions: ThemeGoods Altair versions n/a through 5.2.2 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions n/a through 5.2.2, update to a version later than 5.2.2 to resol...

CVE-2025-48134

Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC WP Tabs allows Object Injection. This issue affects WP Tabs: from n/a through 2.2.11...

CVE-2025-4742 XU-YIJIE grpo-flat grpo_vanilla.py main deserialization

A vulnerability classified as problematic has been found in XU-YIJIE grpo-flat up to 9024b43f091e2eb9bac65802b120c0b35f9ba856. Affected is the function main of the file grpovanilla.py. The manipulation leads to deserialization. Local access is required to approach this attack. Continious delivery...

CVE-2025-4740

CVE-2025-4740 affects BeamCtrl Airiana up to v11.0, with a deserialization vulnerability in the coef file leading to a local attack. Exploit disclosed; impact details in CVSS metrics indicate partial confidentiality/integrity/availability. Public fixes are not documented in the provided sources; ...

CVE-2025-4701

The CVE-2025-4701 issue affects VITA-MLLM Freeze-Omni (up to 20250421), specifically the torch.load usage in models/utils.py where improper handling of the path argument enables deserialization and a potential local-host exploit. Root cause: manipulation of the path parameter in torch.load leads ...

emlog code issue vulnerabilities

emlog is emlog open source a PHP and MySQL based CMS website builder. A code issue vulnerability exists in emlog 2.5.13 and earlier versions, which stems from a deserialization vulnerability that could lead to a deserialization failure...

SAP NetWeaver Deserialization Vulnerability

SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content...

CVE-2025-47292

Cap Collectif is an online decision making platform that integrates several tools. Before commit 812f2a7d271b76deab1175bdaf2be0b8102dd198, the DebateAlternateArgumentsResolver deserializes a Cursor, allowing any classes and which can be controlled by unauthenticated user. Exploitation of this...

CVE-2025-47292 Cap Collectif vulnerable to insecure deserialization leading to remote code execution

Cap Collectif is an online decision making platform that integrates several tools. Before commit 812f2a7d271b76deab1175bdaf2be0b8102dd198, the DebateAlternateArgumentsResolver deserializes a Cursor, allowing any classes and which can be controlled by unauthenticated user. Exploitation of this...

CVE-2025-3623

CVE-2025-3623 : In Uncanny Automator for WordPress (

CVE-2025-32363

mediDOK before 2.5.18.43 allows remote attackers to achieve remote code execution on a target system via deserialization of untrusted data...

CVE-2025-30384

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally...

CVE-2025-30378

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally...

CVE-2025-30382

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally...

CVE-2025-30378

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally...

CVE-2025-42999 Insecure Deserialization in SAP NetWeaver (Visual Composer development server)

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system...

PT-2025-20992 · Microsoft · Sharepoint Server

Name of the Vulnerable Software and Affected Versions: Microsoft Office SharePoint affected versions not specified Description: The issue concerns the deserialization of untrusted data in Microsoft Office SharePoint, allowing an unauthorized attacker to execute code locally. This enables remote...

PT-2025-20616 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A deserialization vulnerability is present. No further details are available. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...

CVE-2025-47629

Deserialization of Untrusted Data vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Object Injection.This issue affects WP-CRM System: from n/a through = 3.4.5...

PT-2025-45220

Name of the Vulnerable Software and Affected Versions VictorThemes Seil versions prior to 1.7.2 Description This issue involves the deserialization of untrusted data, which allows for PHP Object Injection. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a...