10087 matches found
Adobe ColdFusion - Deserialization of Untrusted Data
Adobe ColdFusion versions 2018u17 and earlier, 2021u7 and earlier and 2023u1 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. id: CVE-2023-38203 info: name:...
Veeam Backup & Replication - Unauthenticated
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution RCE. id: CVE-2024-40711 info: name: Veeam Backup & Replication - Unauthenticated author: rootxharsh,iamnoooob,DhiyaneshDK severity: critical description: | A deserializati...
CVE-2026-58025
CVE-2026-58025 — MediaWiki PHP Deserialization RCE via Log Entry Import WikiImporter → LogEntryBase::extractParams → unserialize user-controlled logparams → RCE Overview CVE-2026-58025 is a critical CVSS 9.8 deserialization of untrusted data vulnerability in MediaWiki Wikimedia Foundation. The...
cve-2020-8165-demo
CVE-2020-8165 Demo Yet another demo of CVE-2020-8165, though in a more realistic implementation than most. Background CVE-2020-8165 A deserialization of untrusted data vulnernerability exists in rails 5.2.4.3, rails 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in...
CVE-2024-29847
CVE-2024-29847 PoC for Ivanti Endpoint Manager AgentPortal Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2024-29847 A root cause analysis of the vulnerability can be found on my blog: https://summoning.team/blog/ivanti-epm-CVE-2024-29847-deserialization-RCE/ Usage...
CVE-2021-25641-Proof-of-Concept
The 0xDABB of Doom - CVE-2021-25641-Proof-of-Concept Apache/Alibaba Dubbo = 2.7.3 PoC Code for CVE-2021-25641 RCE via Deserialization of Untrusted Data; Affects Versions = 2.7.6 With Different Gadgets Covered in-depth in the article "The 0xDABB of Doom", published on the Checkmarx blog...
CVE-2020-7961-payloads
CVE-2020-7961-payloads Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services JSONWS Step 1 Write Your payload in LifExp.java Step 2 Compile it with javac Step 3 make your log server Maybe you want to use...
CVE-2025-53690
CVE-2025-53690 Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager XM, Sitecore Experience Platform XP allows Code Injection.This issue affects Experience Manager XM: through 9.0; Experience Platform XP: through 9.0. How does this detection method work? This Nuclei...
Exploit for CVE-2026-115560
Check · Exploit · Detection · Impact · Write-up --- Discl...
CVE-2024-11394
CVE-2024-11394 Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability High-level overview and effects of the vulnerability: The vulnerability allows an attacker to execute arbitrary code on the host machine by supplying a malicious reformer trax...
CVE-2024-11393
CVE-2024-11393 Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability High-level overview and effects of the vulnerability: The vulnerability allows an attacker to execute arbitrary code on the host machine by supplying a malicious...
CVE-2024-24590
CVE-2024-24590 Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with. Usage 1. paste the credentials given and run...
CVE-2026-45659
CVE-2026-45659 Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized...
CVE-2020-35488
I have found a vulnerability in product: nxlog-ce2.10.2150. I have tested my PoC only on Linux Debian 10 and Windows Windows Server 2016. 1 Description : Scope : NXLOG Community Edition 2.10.2150 Bug Type : CWE-502, Deserialization of Untrusted Data https://cwe.mitre.org/data/definitions/502.html...
CVE-2026-114704
Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4...
EUVD-2026-109297
Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4...
CVE-2026-114704 WordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4...
CVE-2016-5983
CVE-2016-5983 IBM WebSphere deserialization of untrusted data - IBM WebSphere 7,8,8.5,9 Link to Original Writeup Source: https://techblog.mediaservice.net/2016/10/cve-2016-5983-ibm-websphere-deserialization-of-untrusted-data/ Title: IBM WebSphere deserialization of untrusted data Application: IBM...