CVE-2024-29847

CVE-2024-29847 PoC for Ivanti Endpoint Manager AgentPortal Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2024-29847 A root cause analysis of the vulnerability can be found on my blog: https://summoning.team/blog/ivanti-epm-CVE-2024-29847-deserialization-RCE/ Usage...

CTF_Django_CVE-2022-34265

CTFCVE-2022-34265 Descripción Se descubrió un problema en Django 3.2 anterior a 3.2.14 y 4.0 anterior a 4.0.6. Las funciones de base de datos Trunc y Extract son susceptibles a inyección SQL si se utilizan datos no confiables como valor del parámetro kind/lookupname. Las aplicaciones que restring...

CVE-2026-58025

CVE-2026-58025 — RCE por deserialización de PHP en MediaWiki mediante la importación de entradas de registro WikiImporter → LogEntryBase::extractParams → unserialize de logparams controlados por el usuario → RCE Resumen CVE-2026-58025 es una vulnerabilidad crítica CVSS 9.8 de deserialización de...

Adobe ColdFusion - Deserialization of Untrusted Data

Adobe ColdFusion versions 2018u17 and earlier, 2021u7 and earlier and 2023u1 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. id: CVE-2023-38203 info: name:...

Veeam Backup & Replication - Unauthenticated

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution RCE. id: CVE-2024-40711 info: name: Veeam Backup & Replication - Unauthenticated author: rootxharsh,iamnoooob,DhiyaneshDK severity: critical description: | A deserializati...

CVE-2016-5983

CVE-2016-5983 IBM WebSphere deserialización de datos no confiables - IBM WebSphere 7,8,8.5,9 Enlace a la fuente original del informe: https://techblog.mediaservice.net/2016/10/cve-2016-5983-ibm-websphere-deserialization-of-untrusted-data/ Título: IBM WebSphere deserialización de datos no confiabl...

CVE-2024-11394

CVE-2024-11394 Vulnerabilidad de ejecución remota de código por deserialización de datos no confiables en el modelo Trax de Hugging Face Transformers Descripción general y efectos de la vulnerabilidad: La vulnerabilidad permite a un atacante ejecutar código arbitrario en la máquina anfitriona al...

CVE-2024-24590

CVE-2024-24590 Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with. Usage 1. paste the credentials given and run...

cve-2020-8165-demo

Demostración de CVE-2020-8165 Otra demostración más de CVE-2020-8165, aunque con una implementación más realista que la mayoría. Antecedentes CVE-2020-8165 Existe una vulnerabilidad de deserialización de datos no confiables en rails 5.2.4.3, rails 6.0.3.1 que puede permitir a un atacante...

CVE-2020-35488

He encontrado una vulnerabilidad en el producto: nxlog-ce2.10.2150. He probado mi PoC solo en Linux Debian 10 y Windows Windows Server 2016. 1 Descripción : Alcance : NXLOG Community Edition 2.10.2150 Tipo de bug : CWE-502, Deserialización de datos no confiables...

CVE-2020-7961-payloads

CVE-2020-7961-payloads Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services JSONWS Step 1 Write Your payload in LifExp.java Step 2 Compile it with javac Step 3 make your log server Maybe you want to use...

CVE-2024-24926

CVE-2024-24926 CVE-2024-24926 Vulnerability affects the Brooklyn theme for WordPress Description: The CVE-2024-24926 vulnerability affects the Brooklyn theme for WordPress versions up to 4.9.7.6 and is related to deserialization of untrusted data CWE-502. This allows an attacker to send malicious...

jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution

A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the...

PT-2026-89719

pytorch-lightning is vulnerable to Deserialization of Untrusted Data...

Security Updates for Microsoft Publisher Products C2R (September 2026)

The Microsoft Publisher Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Integer overflow or wraparound in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network. CVE-2026-69742 - Deserialization of untrusted data ...

ManageEngine Desktop Central Java Deserialization

Zoho ManageEngine Desktop Central before 10.0.474 is vulnerable to a deserialization of untrusted data, which permits remote code execution. id: CVE-2020-10189 info: name: ManageEngine Desktop Central Java Deserialization author: king-alexander severity: critical description: | Zoho ManageEngine...

CVE-2026-81385

Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network...

CVE-2026-77484

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network...

CVE-2026-69694

Deserialization of untrusted data in Windows IP Address Management IPAM Service allows an authorized attacker to elevate privileges locally...

CVE-2026-65772

Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network...