Insecure Deserialization

Arbitrary code execution in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier can occur when a high-privileged attacker supplies maliciously crafted serialized data and induces user interaction to trigger deserialization. The flaw is network-reachable and, if exploited, can change scope and fully compromise confidentiality, integrity, and availability, but it requires an authenticated high-privilege (PR:H) account plus a user action (UI:R), so it is not remotely unauthenticated. No public exploit identified at time of analysis; no CISA KEV status is provided, EPSS is 9.54% (95th percentile), and Adobe has published advisory APSB25-105 for patching.

Deserialization of untrusted data in the NVTabular Workflow component on Linux can let attackers achieve code execution, denial of service, information disclosure, and data tampering on affected ML/data-engineering hosts. Per the assessed vector (AV:N/AC:L/PR:N/UI:R), no authentication is needed, but successful exploitation requires the victim to load or deserialize an attacker-supplied workflow object - for example a shared preprocessing pipeline or dataset artifact - so social delivery of a trusted-looking workflow file is a prerequisite. EPSS is low (0.66%, ~50th percentile) and no public exploit has been identified at time of analysis; the vulnerability is serious but conditional and largely confined to NVTabular deployments rather than general-purpose servers.

Deserialization of untrusted data in the NVIDIA Merlin Transformers4Rec Trainer component on Linux can allow an attacker to achieve code execution, denial of service, information disclosure, and data tampering, with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No attacker authentication is required, but exploitation depends on the victim loading or processing an attacker-controlled serialized artifact (model or checkpoint) through the Trainer - the mandatory victim action captured by the UI:R metric. There is no public exploit identified at time of analysis and the EPSS score is low (0.66%, ~50th percentile), so risk is concentrated in environments that ingest untrusted or externally sourced checkpoints; confidential NVIDIA advisory answer ID 5739 should be consulted for the exact affected versions and the specific serialization mechanism.

Deserialization of untrusted data in WP Maps WordPress plugin versions up to 4.8.6 allows high-privileged authenticated users to inject and instantiate arbitrary PHP objects, potentially leading to code execution or privilege escalation. While the CVSS score of 6.5 reflects high confidentiality and integrity impact, the requirement for administrator-level privileges (PR:H) and user interaction (UI:R) significantly constrains real-world exploitability. EPSS score of 0.04% indicates minimal observed exploitation likelihood despite the vulnerability's technical severity.

A critical remote code execution vulnerability exists in CSLA .NET framework versions 5.5.4 and below due to insecure deserialization when using WcfProxy with the obsolete NetDataContractSerializer. This vulnerability allows unauthenticated remote attackers to execute arbitrary code on affected systems without user interaction, potentially leading to complete system compromise. While no active exploitation has been reported in CISA KEV and no public POC is mentioned, the vulnerability's network-exposed nature and low attack complexity make it a high-priority security concern.

Remote code execution in SAP jConnect, SAP's JDBC driver for SAP ASE (Sybase), lets a high-privileged user trigger unsafe deserialization with specially crafted input, yielding complete loss of confidentiality, integrity, and availability on the affected system. The CVSS 9.1 score reflects network reachability and no user interaction, but the PR:H vector and the vendor's unspecified 'under certain conditions' precondition mean realistic risk is substantially lower in environments where high-privilege access is tightly controlled. EPSS is elevated at 9.48% (95th percentile), yet no public exploit has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).

HummerRisk thru v1.5.0 is using a vulnerable Snakeyaml component, allowing attackers with normal user privileges to hit the /rule/add API and thereby achieve RCE and take over the server.

UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed to PHP unserialize() without proper handling, allowing remote, unauthenticated attackers to inject arbitrary PHP objects and potentially write and execute arbitrary PHP code.

An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file with a CODESYS development system. This arbitrary code is executed in the user context.

Deserialization in nutzam NutzBoot's LiteRpc-Serializer component allows remote attackers to potentially read sensitive data from affected systems. An exploit is publicly available; no active exploitation has been confirmed. The vulnerability carries an extremely low CVSS 4.0 score of 2.9 due to high attack complexity and limited confidentiality impact, though real-world impact may be greater if deserialization gadget chains permit arbitrary code execution.

The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.6 via deserialization of untrusted input in saved-search-item.php. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Fugue is a unified interface for distributed computing that lets users execute Python, Pandas, and SQL code on Spark, Dask, and Ray with minimal rewrites. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.

An issue was discovered in jishenghua JSH_ERP 2.3.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

An issue was discovered in jishenghua JSH_ERP 2.3.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

An issue was discovered in jishenghua JSH_ERP 2.3.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

An issue was discovered in jishenghua JSH_ERP 2.3.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

An issue was discovered in jishenghua JSH_ERP 2.3.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

An issue in the cms_rest.php component of SIGB PMB v8.0.1.14 allows attackers to execute arbitrary code via unserializing an arbitrary file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

A flaw was found in the Keycloak LDAP User Federation provider. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

PHP object injection in WP Webhooks plugin versions through 3.3.8 allows authenticated administrators to execute arbitrary code through unsafe deserialization of untrusted data. Exploitation requires high-privilege WordPress admin access but achieves complete system compromise once triggered. EPSS score of 0.09% indicates low observed exploitation despite network-reachable attack vector, likely due to the elevated privilege requirement limiting real-world opportunities.

Deserialization of Untrusted Data vulnerability in Icegram Email Subscribers & Newsletters email-subscribers allows Object Injection.9.10. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Microsoft SharePoint Online Elevation of Privilege Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

IBM webMethods Integration 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fix6 IBM webMethods Integration allow an authenticated user to execute arbitrary. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The WP Import - Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.33.1. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Public exploit code available.

The AI Engine plugin for WordPress is vulnerable to PHP Object Injection via PHAR Deserialization in all versions up to, and including, 3.1.8 via deserialization of untrusted input in the. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable. No vendor patch available.

The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documents. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available.

ktg-mes before commit a484f96 (2025-07-03) has a fastjson deserialization vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

The Academy LMS - WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.8 via deserialization of. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for iOS before 7.1.2, and AnyDesk for Android before 8.0.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Deserialization of Untrusted Data vulnerability in uxper Togo togo.0.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Deserialization of Untrusted Data vulnerability in WP User Manager WP User Manager wp-user-manager allows Object Injection.9.12. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Deserialization of Untrusted Data vulnerability in Cristián Lávaque s2Member s2member allows Object Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Object Injection.2.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Deserialization of Untrusted Data vulnerability in sbouey Falang multilanguage falang allows Object Injection.3.65. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.10.2. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Deserialization of Untrusted Data vulnerability in NooTheme Yogi - Health Beauty & Yoga noo-yogi allows Object Injection.9.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

PHP object injection in NooTheme WeMusic WordPress theme version ≤1.9.1 allows authenticated attackers with low privileges to execute arbitrary code or manipulate application logic through unsafe deserialization of untrusted data. Reported by Patchstack audit team. EPSS exploitation probability is low (0.10%, 27th percentile), indicating limited observed attacker interest despite the critical CVSS 8.8 rating. No active exploitation confirmed by CISA KEV at time of analysis.

Deserialization of Untrusted Data vulnerability in VictorThemes Seil seil allows Object Injection.7.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Deserialization of Untrusted Data vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Object Injection.3.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

PHP object injection in WordPress plugin Preserve Code Formatting 4.0.1 and earlier enables authenticated attackers to execute arbitrary code or manipulate application state. Remote attackers with low-privilege WordPress accounts (Contributor-level or above) can inject malicious serialized objects through unsafe deserialization, achieving high impact to confidentiality, integrity, and availability. EPSS score of 0.10% indicates minimal widespread exploitation activity, though the vulnerability requires only low-complexity exploitation with no user interaction once authenticated access is obtained.

Deserialization of Untrusted Data vulnerability in wpdreams Ajax Search Lite ajax-search-lite allows Object Injection.13.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Dataease is an open source data visualization analysis tool. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

The Everest Forms (Pro) plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input in the mime_content_type(). Rated medium severity (CVSS 5.6), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Pre-authentication SQL injection in the WordPress plugin Contact Form CFDB7 (all versions up to and including 1.3.2) cascades into PHP object injection, allowing remote attackers to reach code paths that can fully compromise confidentiality, integrity, and availability of an affected WordPress site. The CVSS vector (AV:N/AC:L/PR:N) confirms the attack is remotely reachable and unauthenticated, and the plugin must simply be installed and active on the target - no valid account or victim action is required in practice. Exploitation status is unconfirmed: there is no CISA KEV entry and no public exploit code identified at time of analysis, and the EPSS score is low at 0.33% (24th percentile), so this appears to be a severe but not yet broadly exploited issue; it was disclosed by Mandiant (MNDT-2025-0006).

Remote code execution in Shiyi Blog up to version 1.2.1 allows authenticated remote attackers to execute arbitrary code via unsafe deserialization in the Job Handler component (SysJobController.java). The CVSS score of 2.1 reflects required authenticated access and limited scope, but the combination of public exploit availability, demonstrated deserialization flaw, and network accessibility creates moderate operational risk despite the low severity rating.

Remote code execution in Rox, the PHP platform powering the BeWelcome hospitality-exchange community, arises from unsafe unserialize() calls on attacker-controllable input: the POST parameter `formkit_memory_recovery` handled by RoxPostHandler::getCallbackAction and the `bwRemember` 'memory cookie' read by RoxModelBase::getMemoryCookie. Because usable PHP gadget chains ship in Rox and its bundled libraries, an attacker with low-level access can trigger PHP object injection to write arbitrary files or execute code, resulting in full site compromise. The issue carries a CVSS 4.0 base score of 9.4 and was fixed in commit c60bf04 (2025-06-16); no public exploit identified at time of analysis, though a referenced technical gist may contain exploitation detail.

PHP object injection (untrusted deserialization) in the eyecix JobSearch WordPress plugin affects every release below 3.0.8, allowing a remote attacker to pass crafted serialized data into the plugin's deserialization path. Per the assigned CVSS vector no authentication (PR:N) or user interaction (UI:N) is required, so exploitation is network-reachable against any site running an affected version; however, the independent assessment rates attack complexity as High (AC:H) because a working POP/gadget chain must exist in the plugin or its WordPress environment, and the very low EPSS of 0.58% (46th percentile) reflects that practical weaponization is not trivial despite the 9.8 severity headline. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor-published fix is version 3.0.8.

PHP object injection in the Acowebs Product Table For WooCommerce plugin (affected through version 1.2.4) lets an authenticated attacker supply serialized PHP data that the plugin passes to unserialize(), potentially leading to arbitrary object instantiation within the WordPress process. The vulnerability is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H) and requires a valid low-privilege WordPress session - such as a subscriber or WooCommerce customer account on stores that permit open registration; concrete impact such as file deletion, data exfiltration, or remote code execution depends on the presence of a usable POP gadget chain in WordPress core, WooCommerce, or installed themes/plugins, which is not confirmed in the source data. No public exploit identified at time of analysis, the issue does not appear in CISA KEV, and EPSS is 0.52% (42nd percentile), indicating low predicted exploitation activity at this time.

PHP object injection in UNIVERSAM WordPress plugin through deserialization of untrusted data allows remote unauthenticated attackers to achieve critical impact including remote code execution, complete data compromise, and denial of service. Affects all versions up to and including 9.03. EPSS exploitation probability is relatively low at 0.10% (28th percentile), with no public exploit identified at time of analysis, suggesting a lower immediate real-world risk despite the critical CVSS 9.8 score.

PHP object injection in the designthemes Single Property WordPress theme (versions through 2.8) lets an authenticated low-privilege user supply crafted serialized input that the theme deserializes without validation, potentially leading to full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only WordPress sites with the theme installed and active are affected, and per the assessed vector anonymous unauthenticated exploitation is not supported - a low-privilege account is required, with no user interaction and low attack complexity. There is no confirmed active exploitation (the CVE is not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is low at 0.53% (43rd percentile), though practical impact depends on whether a usable POP gadget chain exists in the theme or another installed plugin/theme.

Remote PHP object injection in KBx Pro Ultimate (knowledgebase-helpdesk-pro) up to version 8.0.5 allows attackers to supply crafted serialized data that the WordPress plugin deserializes without proper validation. The 9.8 CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network-reachable, low-complexity, unauthenticated exploitation with full confidentiality, integrity, and availability impact, although the advisory does not explicitly confirm that the deserialization sink is reachable without authentication; defenders should verify exposure in their configuration. Practical code execution is gated on the presence of a usable PHP POP gadget chain, and no public exploit code has been identified at time of analysis; EPSS is low at 0.58% (46th percentile).

PHP object injection in the designthemes Knowledge Base WordPress theme (versions up to and including 2.9) allows an authenticated low-privilege user to pass untrusted serialized data into a PHP unserialize() call, which can lead to object injection and potentially full confidentiality, integrity, and availability impact (CVSS 8.8). Exploitation requires a valid low-privilege account on the target site (CVSS PR:L), and real-world impact is further gated by the presence of a usable POP/gadget chain in the theme, WordPress core, or co-installed plugins. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV); EPSS is low at roughly 0.53% (43rd percentile), reflecting limited observed activity.

PHP object injection in the axiomthemes White Rabbit WordPress theme through version 1.5.2 can allow remote attackers to pass crafted serialized data to a PHP unserialize() call, potentially causing object-injection side effects or code execution if a usable gadget chain exists. The vendor CVSS vector is 9.8 with PR:N/UI:N, suggesting unauthenticated remote exploitation, but our independent assessment raises attack complexity to High because successful code execution depends on a reachable POP chain in the theme, WordPress core, or an active plugin; no public exploit identified at time of analysis, no CISA KEV listing is present, and EPSS is low at 0.58% (46th percentile).

PHP object injection in the AncoraThemes BugsPatrol WordPress theme (versions through 1.5.0) allows unauthenticated remote attackers to pass untrusted input to a PHP unserialize() call, enabling arbitrary object instantiation that can lead to remote code execution, file write, SQL injection, or data deletion if a usable POP gadget chain exists in the theme, WordPress core, or another installed plugin. The initial CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the independent assessment adjusts attack complexity to High (AC:H) because a viable gadget chain and reachable vulnerable code path are prerequisites for meaningful impact. EPSS is low at 0.59% (47th percentile), and no public exploit code or CISA KEV entry has been identified. No vendor-released patch or fixed version is identified in the provided advisory data at time of analysis.

PHP object injection in the WordPress plugin Subscribe to Download (versions up to and including 2.0.9) allows an unauthenticated remote attacker to pass crafted serialized input into an unsafe PHP unserialize() call, which can trigger magic-method execution and potentially lead to remote code execution, arbitrary file operations, or sensitive data disclosure depending on which gadget chains are reachable on the target. NVD rates the issue 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), while an independent assessment applies AC:H because successful exploitation additionally depends on a usable POP gadget chain being present in the plugin, WordPress core, or another installed plugin or theme; the practical risk is therefore highly site-dependent. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, with EPSS at 0.58% (46th percentile), indicating low observed exploitation likelihood despite the high base score.

PHP object injection in the WordPress plugin Captivate Sync (slug captivatesync-trade) through version 3.0.3 lets remote, unauthenticated attackers feed crafted serialized input into a PHP unserialize() path, which vendor/NVD scoring rates at CVSS 9.8 with full confidentiality, integrity and availability impact. Our independent assessment revises the vector to AC:H, because turning object injection into real impact requires a usable POP gadget chain in the plugin or another loaded component, and the available data does not confirm that such a chain exists. There is no public exploit identified at time of analysis, EPSS is low at 0.58% (46th percentile), the issue is not in CISA KEV, and real-world exposure is bounded by the plugin's narrow deployment footprint and by whether the vulnerable deserialization endpoint is reachable in a given configuration.

PHP object injection in BoldThemes Addison WordPress theme versions prior to 1.4.8 enables unauthenticated remote attackers to execute arbitrary code through unsafe deserialization. The vulnerability carries a critical CVSS 9.8 score with network-accessible attack vector requiring no privileges or user interaction. No public exploit identified at time of analysis, with EPSS indicating 10th percentile exploitation probability (0.10%), suggesting low observed exploitation likelihood despite high theoretical severity.

PHP object injection in the designthemes Kriya WordPress theme (all versions up to and including 3.4) lets an authenticated low-privilege user pass crafted serialized input into an unserialize() call and instantiate arbitrary PHP objects on the server. Successful exploitation can yield full compromise of confidentiality, integrity and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), though real-world impact is gated by the availability of a usable gadget/POP chain in WordPress core or other installed plugins, without which the flaw is limited to object injection. There is no public exploit identified at time of analysis and no KEV listing; EPSS is low at 0.53% (43rd percentile), and no fixed version is confirmed in the available data.

PHP object injection in BoldThemes Goldenblatt WordPress theme versions prior to 1.3.0 enables unauthenticated remote attackers to execute arbitrary code through deserialization of untrusted data. The vulnerability scores 9.8 (Critical) with network-exploitable attack vector requiring no privileges or user interaction. EPSS indicates low probability (0.10%, 28th percentile) of active exploitation, and no public exploit or KEV listing identified at time of analysis, suggesting theoretical high severity but currently limited real-world exploitation activity.

PHP object injection affects the Whitebox-Studio Scape WordPress theme through version 1.5.13, where attacker-supplied data reaches a PHP unserialize() call and can be turned into remote code execution, file write, or SQL injection if a usable POP gadget chain exists in the theme, WordPress core, or a co-installed plugin. The NVD vector rates the flaw 9.8 (AV:N/AC:L/PR:N), but the assessed vector is 8.1 (AC:H) because the exact vulnerable feature and the availability of a working gadget chain are not documented, and the PR:N rating is not corroborated by any detail in the advisory. Exploitation risk is otherwise low: EPSS is 0.58% (46th percentile) and no public exploit code or CISA KEV entry has been identified at time of analysis.

Authenticated attackers with low privileges can exploit a PHP object injection flaw in the VEDA WordPress theme through version 4.2, potentially achieving high confidentiality, integrity, and availability impact if a usable gadget chain exists in the theme or co-installed plugins. The vulnerability stems from deserialization of untrusted data (CWE-502) and carries a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit identified at time of analysis, and EPSS is 0.53% (43rd percentile), indicating limited near-term exploitation likelihood.

PHP Object Injection in the Everest Forms - Frontend Listing WordPress plugin (versions through 1.0.5) lets unauthenticated remote attackers feed attacker-controlled data into a PHP unserialize() sink, potentially triggering arbitrary object instantiation on the target site. The CVSS base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) per the reporter, while our independent assessment keeps the same scope of impact but raises attack complexity to High (AC:H) because a working exploitation path depends on an exploitable POP gadget chain being present in the plugin, Everest Forms core, or another active plugin or theme. EPSS is low at 0.50% (41st percentile), there is no KEV listing, and no public exploit code has been identified at time of analysis.

PHP Object Injection in the CRM Perks Connector for Gravity Forms and Google Sheets WordPress plugin (wp-gravity-forms-spreadsheets) through version 1.2.6 allows unauthenticated remote attackers to pass attacker-controlled data to an unserialize() call path when the plugin is installed, active, and processing form/data integration functionality. Meaningful impact such as RCE, file manipulation, or SQL injection depends on a usable POP gadget chain being present in the plugin, WordPress core, or another installed component, which is the key real-world limiting factor despite the high CVSS score. EPSS is low at 0.58% (46th percentile), and no public exploit code or CISA KEV entry is identified at time of analysis.

PHP Object Injection in the rascals 'Noisa' WordPress theme (versions through 2.6.0) lets a remote, unauthenticated attacker supply crafted serialized input that the theme passes to PHP's unserialize(), enabling object injection (CWE-502). The published CVSS 3.1 vector scores this 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but our assessment raises attack complexity to High (AC:H) because a practical confidentiality/integrity/availability impact depends on an exploitable POP gadget chain existing in the theme, WordPress core, or a co-installed plugin. EPSS is only 0.56% (45th percentile), the issue is not listed in CISA KEV, and no public exploit code was identified at time of analysis; real-world exposure is further limited by the theme's niche install base and the gadget-chain prerequisite. Note that per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required to reach the vulnerable path.

Unauthenticated remote code execution in TF Woo Product Grid Addon for Elementor versions up to 1.0.1 allows complete site compromise via PHP object injection. The vulnerability stems from insecure deserialization (CWE-502) of untrusted input, exploitable without authentication or user interaction. No

PHP object injection in the Boldermail plugin for WordPress (all versions up to and including 2.4.0) allows a low-privilege authenticated user to pass crafted serialized data into an unserialize() call, enabling arbitrary PHP object instantiation that can escalate to remote code execution, file manipulation, or database compromise when a usable POP gadget chain is reachable. The flaw is network-reachable with low attack complexity and no user interaction (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N). Exploitation is materially constrained by the PR:L authentication prerequisite and by the availability of a gadget chain in the plugin, WordPress core, or another installed plugin; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS score is low (0.53%, 43rd percentile).

PHP object injection (CWE-502) in the WordPress plugin WP Store Locator through version 2.2.260 allows an authenticated attacker to pass crafted serialized data into a PHP unserialize() sink, potentially achieving arbitrary object instantiation and, if a usable POP gadget chain exists in the loaded codebase, serious downstream impact scored at CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the vector carries PR:L, exploitation requires a low-privileged authenticated account such as a subscriber or contributor - anonymous exploitation is not indicated - and no user interaction is needed. EPSS is low at 0.46% (38th percentile) and there is no CISA KEV listing; no public exploit identified at time of analysis.

PHP object injection in WooCommerce Vehicle Parts Finder plugin versions up to 3.7 enables remote unauthenticated attackers to achieve arbitrary code execution via deserialization of untrusted data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible exploitation without authentication or user interaction. Reported by Patchstack audit team, this represents a critical pre-authentication vulnerability in WordPress e-commerce environments. EPSS data unavailable; not currently listed in CISA KEV, suggesting limited widespread exploitation at time of disclosure.

Deserialization of untrusted data in the designthemes Solar Energy WordPress theme (versions ≤ 3.5) allows authenticated attackers with low privileges to trigger PHP object injection, potentially leading to code execution or other high-impact effects. The vulnerability has a CVSS score of 8.8, but exploitation requires the theme to be active and a suitable gadget chain to be present; no public exploit code or active exploitation has been identified, and EPSS estimates a 0.61% likelihood of exploitation in the next 30 days. No fixed version is currently documented, so mitigation depends on removing or restricting access to the theme.

PHP Object Injection in the designthemes Insurance theme (versions ≤ 3.5) for WordPress allows authenticated attackers with low-level privileges to inject arbitrary PHP objects via unserialize() of untrusted data, potentially leading to remote code execution if a POP gadget chain exists. The CVSS 3.1 base score is 8.8, reflecting high confidentiality, integrity, and availability impact; exploitation requires an authenticated session (PR:L) and no user interaction (UI:N). EPSS score is 0.63% (48th percentile) and there is no public exploit identified at time of analysis (no KEV, no POC).

Unsafe deserialization in ChurchCRM setup/routes/setup.php allows remote attackers to manipulate DB_PASSWORD, ROOT_PATH, or URL parameters, leading to arbitrary code execution with limited impact. The vulnerability affects versions up to 5.18.0 and has publicly available exploit code, though EPSS exploitation probability remains low at 0.10% percentile, suggesting real-world exploitation is constrained by high attack complexity and difficult exploitability factors.

Remote code execution in pyquokka 0.3.1 and prior allows unauthenticated remote attackers to execute arbitrary commands on a host running a network-exposed FlightServer. The FlightServer.do_action() method at pyquokka/flight.py line 283 passes client-supplied action bodies directly to pickle.loads(), so a crafted set_configs action can trigger command execution; similar unsafe pickle.loads() use exists in cache_garbage_collect, do_put, and do_get. Publicly available exploit code exists, and the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8); the primary prerequisite is a reachable FlightServer bound to a non-local interface such as 0.0.0.0, and no application-level authentication gates the endpoint.

PHP object injection in Vfront 0.99.52's mexcel.php endpoint exposes an unauthenticated POST parameter directly to unserialize() without class restrictions, enabling remote attackers to instantiate arbitrary PHP objects. Depending on exploitable gadget chains present in the Vfront codebase or its PHP dependencies, this can escalate to remote code execution, SQL injection, path traversal, or denial of service. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.40% (32nd percentile), consistent with the absence of a CISA KEV listing.

Remote code execution in the ActiveMQ NMS AMQP .NET client affects all releases up to and including 2.3.0 when the client initiates an AMQP session to an attacker-controlled, compromised, or otherwise untrusted broker; that server can return crafted serialized data the client deserializes without bounds, potentially executing arbitrary code on the client host. The primary prerequisite is control or impersonation of the broker endpoint the client connects to, so deployments that only talk to trusted, internally controlled brokers are not realistically exploitable without first compromising that broker or the network path, and the allow/deny-list deserialization restriction added in 2.1.0 is bypassable so enabling it does not guarantee protection. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); EPSS is 2.09% (81st percentile) and the vendor-released fix is version 2.4.0.

Local privilege escalation in Microsoft Azure Monitor Agent (CPE cpe:2.3:a:microsoft:azure_monitor_agent, all versions covered by the wildcard) lets an attacker who already holds authenticated, low-privileged access on the host feed attacker-controlled serialized data into an unsafe deserialization path and gain elevated privileges - code execution, confidentiality and integrity impact are all rated High, confined to the local system (S:U). This is a moderate-priority, not a drop-everything issue: the attack is local-only with high complexity (AV:L/AC:H/PR:L/UI:N), EPSS is 0.78% (55th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis. Exploitation is contingent on a pre-existing foothold plus the specific agent feature, version, and configuration that expose the vulnerable deserialization path - details that must be confirmed against the MSRC advisory.

Local privilege escalation in Ivanti Endpoint Manager allows an authenticated low-privilege attacker to gain high-integrity control of the host by feeding attacker-controlled serialized data into a vulnerable deserialization path in the EPM software. Affected builds are all EPM versions prior to 2024 SU4, specifically the 2024 base release and service updates SU1, SU2, SU3, and SU3 Security Release 1; systems already on 2024 SU4 or later are not affected. The attack requires an existing local authenticated session (PR:L, AV:L, no user interaction) and is not remotely reachable by an unauthenticated attacker; no public exploit identified at time of analysis, and EPSS is low at 0.78% (55th percentile), so this is a credible but not emergency-tier priority for most environments.

Unauthenticated fastjson deserialization in WukongCRM 9.0 (Java edition) via the /OaExamine/setOaExamine HTTP endpoint allows remote attackers to supply attacker-controlled class references that the Alibaba fastjson library instantiates at runtime, enabling arbitrary Java gadget-chain execution. A public proof-of-concept is available on GitHub, lowering the exploitation bar considerably. While the assigned CVSS scores impact conservatively at I:L/A:L with no confidentiality loss, this is inconsistent with the well-documented RCE potential of fastjson deserialization gadget chains - the actual impact may be understated. No public exploit has been confirmed as actively exploited (not in CISA KEV).

Arbitrary Python code execution in python-socketio versions 0.8.0 through 5.13.x is achievable when a multi-server deployment uses a pickle-based message-queue backend (Redis via the redis_manager/async_redis_manager, Kafka, RabbitMQ via aiopika, or Kombu) because each node deserializes inter-server messages with pickle.loads() without validating their origin. The attack is conditional rather than opportunistic: the adversary must have already obtained write/publish access to the internal message queue, from which they can drop a crafted payload that executes with the full privileges of the Socket.IO server process. No public exploit identified at time of analysis, EPSS is low at 0.48% (40th percentile), and CISA KEV does not list this issue; the vendor fix is version 5.14.0, which removes pickle entirely in favor of JSON encoding.

Deserialization vulnerability in LaChatterie Verger up to 1.2.10 allows remote authenticated attackers with low privileges to abuse the OAuth redirect functionality. By supplying a crafted URL containing malicious serialized data to the `redirectToAuthorization` function, an attacker can trigger deserialization, potentially leading to limited data tampering or service disruption. A public exploit is available, but no active exploitation is confirmed.

DataChain is a Python-based AI-data warehouse for transforming and analyzing unstructured data. Versions 0.34.1 and below allow for deseriaization of untrusted data because of the way the DataChain library reads serialized objects from environment variables (such as DATACHAIN__METASTORE and DATACHAIN__WAREHOUSE) in the loader.py module. An attacker with the ability to set these environment variables can trigger code execution when the application loads. This issue is fixed in version 0.34.2.

The Schema Plugin For Divi, Gutenberg & Shortcodes plugin for WordPress is vulnerable to Object Instantiation in all versions up to, and including, 4.3.2 via deserialization of untrusted input via the wpt_schema_breadcrumbs shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

Pickle deserialization RCE in pyfory 0.12.0-0.12.2 and pyfury 0.1.0-0.10.3.

A vulnerability was detected in pmTicket Project-Management-Software up to 2ef379da2075f4761a2c9029cf91d073474e7486. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

In DOXENSE WATCHDOC before 6.1.1.5332, Deserialization of Untrusted Data can lead to remote code execution through the .NET Remoting library in the Watchdoc administration interface. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

A vulnerability was found in GuanxingLu vlarl up to 31abc0baf53ef8f5db666a1c882e1ea64def2997. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.