CWE-502

Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <=

Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.

Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.

Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.

Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.

Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja For

Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are

Unauthenticated PHP Object Injection in ThemeREX Addons <= 2.36.1.1 versions.

Unauthenticated PHP Object Injection in Hot Coffee <= 1.7 versions.

Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions.

Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions.

Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions.

Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions.

Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions.

Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions.

Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions.

Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions.

Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.

Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.

Deserialization of Untrusted Data vulnerability in Themeton Lagom allows Object Injection. This issue affects Lagom: fr

Deserialization of Untrusted Data vulnerability in Themeton The Barber Shop allows Object Injection. This issue affects

Deserialization of Untrusted Data vulnerability in EMV The Hospital nrghospital allows Object Injection. This issue aff

Deserialization of Untrusted Data vulnerability in EMV Creatify allows Object Injection. This issue affects Creatify: f

Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions.

Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions.

Unauthenticated PHP Object Injection in Moderno < 1.43 versions.

picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous

picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated users to execute arbit

NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code execution vulnerability in the inf

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vul

A remote, unauthenticated attacker may exploit a deserialization of untrusted data vulnerability in ibaPDA or ibaDatCoor

Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attacke

Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions.

Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions.

IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with full application pri

Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Sch

Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated wi

PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to

PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll, registere

An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pivotal CRM 6.6.5.10 a

Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions.

Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce <= 12.10.3 versions.

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deser

Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-qu

A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths whe

Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki:

Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Injection.This issue affec

Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Object Injecti

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection

Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affe