CVE-2025-8227

A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /collect/getArticle. The manipulation of the argument taskUrl leads to deserialization. The attack can be launched remotely. The...

CVE-2025-8227 yanyutao0402 ChanCMS getArticle deserialization

A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /collect/getArticle. The manipulation of the argument taskUrl leads to deserialization. The attack can be launched remotely. The...

PT-2025-30950 · Freescout · Freescout

Name of the Vulnerable Software and Affected Versions: FreeScout versions prior to 1.8.186 Description: FreeScout is a lightweight free open source help desk and shared inbox built with PHP Laravel framework. Versions prior to 1.8.186 contain a critical deserialization vulnerability in the...

CVE-2025-7876

Metasoft MetaCRM

CVE-2025-28961

CVE-2025-28961 corresponds to a deserialization of untrusted data vulnerability in the WordPress URL Shortener plugin (Md Yeasin Ul Haider) 3.0.7 when available, as stated in the sources. The vulnerability is not described as rejected or reserved in the provided materials.

PT-2025-29780 · Unknown · Md Yeasin Ul Haider Url Shortener

Name of the Vulnerable Software and Affected Versions: Md Yeasin Ul Haider URL Shortener versions through 3.0.7 Description: The software contains a deserialization of untrusted data issue that allows object injection. Recommendations: Update Md Yeasin Ul Haider URL Shortener to a version later...

CVE-2025-49839 GHSL-2025-051: GPT-SoVITS Deserialization of Untrusted Data vulnerability

GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in bsroformer.py. The modelchoose variable takes user input e.g. a path to a model and passes it to the uvr function. In uvr, a new instance of...

CVE-2025-49417 WordPress WooCommerce Product Multi-Action plugin <= 1.3 - Deserialization of untrusted data Vulnerability

Deserialization of Untrusted Data vulnerability in BestWpDeveloper WooCommerce Product Multi-Action Woo-product-multiaction allows Object Injection.This issue affects WooCommerce Product Multi-Action: from n/a through = 1.3...

CVE-2025-52827

Deserialization of Untrusted Data vulnerability in uxper Nuss nuss allows Object Injection.This issue affects Nuss: from n/a through = 1.3.3...

PT-2025-27276 · Marvell · Marvell Qconvergeconsole

Name of the Vulnerable Software and Affected Versions: Marvell QConvergeConsole affected versions not specified Description: The issue concerns a deserialization of untrusted data remote code execution vulnerability in the readObjectFromConfigFile function. This allows for remote code execution...

Bypass of Mysql Jdbc Attck for CVE-2025-6507

Credits Le1ahttps://github.com/Le1a A1kaidhttps://github.com/for-A1kaid ph0ebushttps://github.com/ph0ebus Description Attackers can exploit this vulnerability to read any system file and even execute arbitrary code through deserialization. The project manager fixed CVE-2025-6507 which I discovere...

CVE-2025-6279

A vulnerability, which was classified as critical, has been found in Upsonic up to 0.55.6. This issue affects the function cloudpickle.loads of the file /tools/addtool of the component Pickle Handler. The manipulation leads to deserialization. The exploit has been disclosed to the public and may ...

CVE-2025-49507 WordPress CozyStay theme < 1.7.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in LoftOcean CozyStay cozystay allows Object Injection.This issue affects CozyStay: from n/a through 1.7.1...

CVE-2025-48907

Deserialization vulnerability in the IPC module Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2025-5498 slackero phpwcms Custom Source Tab cnt21.readform.inc.php is_file deserialization

A vulnerability was found in slackero phpwcms up to 1.9.45/1.10.8. It has been rated as critical. This issue affects the function filegetcontents/isfile of the file include/inclib/content/cnt21.readform.inc.php of the component Custom Source Tab. The manipulation of the argument cpagecustom leads...

CVE-2025-5497

CVE-2025-5497 affects Slackero’s phpwcms Feedimport Module (processing.inc.php) where manipulating the cnt_text argument leads to deserialization. The vulnerability exists in phpwcms versions up to 1.9.45/1.10.8 and can be triggered remotely; public exploits have been disclosed. A fix is availabl...

CVE-2025-5326

CVE-2025-5326 concerns Zhilink ADP Application Developer Platform (version 1.0.0). The issue affects an unknown functionality in the endpoint /adpweb/wechat/verifyToken/ and is caused by a deserialization vulnerability, enabling remote exploitation. Multiple sources corroborate the vulnerability’...

CVE-2025-48389

CVE-2025-48389 affects FreeScout prior to version 1.8.178. The issue arises from deserialization of untrusted data when using the set function to pass a serialized object string, and deserialization occurs when retrieving an option via the get method, enabling arbitrary code execution. This vulne...

CVE-2025-27526

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability which can lead to JDBC Vulnerability URLEncdoe and backspace bypass. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick 1 to solve it...

CVE-2025-5174 erdogant pypickle pypickle.py load deserialization

A vulnerability was found in erdogant pypickle up to 1.1.5 and classified as problematic. Affected by this issue is the function load of the file pypickle/pypickle.py. The manipulation leads to deserialization. Local access is required to approach this attack. The exploit has been disclosed to th...