CVE-2025-53690

CVE-2025-53690 Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager XM, Sitecore Experience Platform XP allows Code Injection.This issue affects Experience Manager XM: through 9.0; Experience Platform XP: through 9.0. How does this detection method work? This Nuclei...

CVE-2024-11393

CVE-2024-11393 Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability High-level overview and effects of the vulnerability: The vulnerability allows an attacker to execute arbitrary code on the host machine by supplying a malicious...

CVE-2021-25641-Proof-of-Concept

The 0xDABB of Doom - CVE-2021-25641-Proof-of-Concept Apache/Alibaba Dubbo = 2.7.3 PoC Code for CVE-2021-25641 RCE via Deserialization of Untrusted Data; Affects Versions = 2.7.6 With Different Gadgets Covered in-depth in the article "The 0xDABB of Doom", published on the Checkmarx blog...

CVE-2026-78165

Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1. RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was...

CVE-2026-111408

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

CVE-2026-78162

Apache Camel's camel-hazelcast component (specifically camel-hazelcast-starter and camel-quarkus-hazelcast) is vulnerable to CWE-502 Deserialization of Untrusted Data. The root cause is an incomplete fix for CVE-2026-43865 where two configuration paths—ReplicatedHazelcastAggregationRepository#doS...

CVE-2026-78162 Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)

Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a...

CVE-2026-111408 WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

CVE-2026-111408 WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

EUVD-2026-104133

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

CVE-2026-111408

The Quiz And Survey Master WordPress plugin (versions

CVE-2024-24590

CVE-2024-24590 Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with. Usage 1. paste the credentials given and run...

PT-2026-117330

Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1. RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was...

cve-2020-8165-demo

CVE-2020-8165 Demo Yet another demo of CVE-2020-8165, though in a more realistic implementation than most. Background CVE-2020-8165 A deserialization of untrusted data vulnernerability exists in rails 5.2.4.3, rails 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in...

CVE-2016-5983

CVE-2016-5983 IBM WebSphere deserialization of untrusted data - IBM WebSphere 7,8,8.5,9 Link to Original Writeup Source: https://techblog.mediaservice.net/2016/10/cve-2016-5983-ibm-websphere-deserialization-of-untrusted-data/ Title: IBM WebSphere deserialization of untrusted data Application: IBM...

CVE-2024-29847

CVE-2024-29847 PoC for Ivanti Endpoint Manager AgentPortal Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2024-29847 A root cause analysis of the vulnerability can be found on my blog: https://summoning.team/blog/ivanti-epm-CVE-2024-29847-deserialization-RCE/ Usage...

CVE-2026-110886

Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1...

CVE-2026-107436

Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12...

CVE-2026-110886 WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1...

CVE-2026-107436

The WP Chill Strong Testimonials WordPress plugin is vulnerable to PHP Object Injection due to the deserialization of untrusted data . This issue affects versions from n/a through 3.3.12 . An attacker could exploit this to perform Object Injection , potentially impacting the confidentiality, inte...