CVE-2025-43708

CVE-2025-43708 affects Visicut 2.1. The vulnerability arises from insecure deserialization of XML documents containing nested set elements, which can trigger a java.util.HashMap StackOverflowError (e.g., when reference is '../../../set/set[2]'), leading to stack consumption. Multiple sources corr...

Deserialization Attack

Picklescan is vulnerable to Deserialization Attack. The vulnerability is due to insecure deserialization by Picklescan's failure to detect malicious pickles, which allows an attacker to exfiltrate sensitive information via DNS...

📄 BentoML 1.4.2 Remote Code Execution

A remote code execution vulnerability caused by insecure deserialization has been identified in version 1.4.2 of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. This module requires Metasploit: https://metasploit.com/download Current source:...

Insecure Deserialization

lmdeploy is vulnerable to Insecure Deserialization. The vulnerability is due to unsafe handling in the loadweightckpt of the file lmdeploy/lmdeploy/vl/model/utils.py of the component PT File Handler, allowing local attackers to exploit it...

Remote Code Execution (RCE)

BentoML is vulnerable to Remote Code Execution RCE. The vulnerability is due to insecure deserialization due to an unsafe code segment in serde.py that allows arbitrary code execution by unauthenticated users...

Atlas (Havelsan) Insecure Deserialization

Atlas Havelsan suffers from a BinaryFormatter insecure deserialization vulnerability. Exploit Title: Havelsan Atlas HBYS - Insecure Deserialization RCE Date: 2025-04-14 Exploit Author: Ahmet Ümit BAYRAM Vendor: https://github.com/havelsan/atlas Version: latest Tested on: Windows 10 - 64bit CVE: N...

Mars: insecure deserilize object leads to RCE On Sitecore (CVE-██████████-27218)

This critical vulnerability involved an insecure deserialization issue in Sitecore implementation, which was assigned CVE-2025-27218. The vulnerability allowed remote code execution through unsanitized user input in the ThumbnailsAccessToken header. The vulnerability was remediated by removing...

PYSEC-2025-32

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized...

CVE-2025-32375

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized...

PYSEC-2025-32

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized...

CVE-2025-32375 Insecure Deserialization leads to RCE in BentoML's runner server

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized...

CVE-2025-32375 Insecure Deserialization leads to RCE in BentoML's runner server

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized...

CVE-2025-32375

Summary: CVE-2025-32375 affects BentoML prior to version 1.4.8, due to an insecure deserialization in BentoML’s runner server. The vulnerability allows an attacker to craft POST requests with specific headers/parameters to execute arbitrary code on the server, giving initial access and informatio...

CVE-2025-32375 Insecure Deserialization leads to RCE in BentoML's runner server

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized...

GHSA-7V4R-C989-XH26 BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure Deserialization

Summary There was an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized arbitrary code on the server, which will grant the attackers to have the initial access and information disclosure o...

BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure Deserialization

Summary There was an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized arbitrary code on the server, which will grant the attackers to have the initial access and information disclosure o...

PT-2025-15707

Name of the Vulnerable Software and Affected Versions BentoML versions 1.0.0a1 through 1.4.7 Description The issue is related to an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized...

Artica Proxy 4.50 - Remote Code Execution (RCE)

Exploit Title: Artica Proxy 4.50 - Remote Code Execution RCE Date: 23-04-2024 Exploit Author: Madan Vendor Homepage: https://artica-proxy.com/ Version: 4.40, 4.50 Tested on: relevant os CVE : CVE-2024-2054 you can also find the exploit on my github repo: https://github.com/Madan301/CVE-2024-2054...

BentoML's runner server RCE

There was an insecure deserialization in BentoML's runner server prior to version 1.4.8. By setting specific headers and parameters in the POST request, it is possible to execute unauthorized arbitrary code in the context of the user running the server, which will grant initial access and...

📄 Artica Proxy 4.50 Remote Code Execution

Artica Proxy version 4.50 suffers from a remote code execution vulnerability due to insecure deserialization. Exploit Title: CVE-2024-2054 Artica-Proxy administrative web application insecure deserialization RCE Google Dork: Date: 23-04-2024 Exploit Author: Madan Vendor Homepage:...