CWE-502

{
  "affected": [],
  "aliases": [
    "CVE-2026-39467"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-21T10:16:29Z",
    "severity": "HIGH"
  },
  "details": "Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider allows Object Injection.This issue affects Responsive Slider by MetaSlider: from n/a through 3.106.0.",
  "id": "GHSA-pccm-93c8-h8qm",
  "modified": "2026-04-21T12:30:24Z",
  "published": "2026-04-21T12:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39467"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/ml-slider/vulnerability/wordpress-responsive-slider-by-metaslider-plugin-3-106-0-php-object-injection-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-49781"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-15T21:17:22Z",
    "severity": "CRITICAL"
  },
  "details": "Unauthenticated PHP Object Injection in OttoKit \u003c= 1.1.27 versions.",
  "id": "GHSA-pf55-gh7m-56fg",
  "modified": "2026-06-15T21:30:50Z",
  "published": "2026-06-15T21:30:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49781"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/suretriggers/vulnerability/wordpress-ottokit-plugin-1-1-27-php-object-injection-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "laravel/framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.7.0"
            },
            {
              "fixed": "6.20.44"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-9081"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-19T20:35:32Z",
    "nvd_published_at": "2019-02-24T17:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "The Illuminate component of Laravel Framework 5.7.x has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the `__destruct` method of the PendingCommand class in `PendingCommand.php`.",
  "id": "GHSA-pfg4-p438-p874",
  "modified": "2023-09-28T20:37:44Z",
  "published": "2022-05-14T01:31:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9081"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laworigin/Laworigin.github.io/blob/master/2019/02/21/laravelv5-7%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96rce/index.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/laravel/framework"
    },
    {
      "type": "WEB",
      "url": "https://github.com/laravel/framework/discussions/40184"
    },
    {
      "type": "WEB",
      "url": "https://laworigin.github.io/2019/02/21/laravelv5-7%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96rce"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Laravel Framework Deserialization Vulnerability"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.alipay.sofa:hessian"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.alipay.sofa:hessian"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.3.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-9212"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-184",
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:49:03Z",
    "nvd_published_at": "2019-02-27T17:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklisting of com.caucho.naming.QName and com.sun.org.apache.xpath.internal.objects.XString is mishandled, related to Resin Gadget.",
  "id": "GHSA-pfwp-8pq4-g7pv",
  "modified": "2024-03-21T16:02:59Z",
  "published": "2019-03-06T17:36:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9212"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alipay/sofa-hessian/issues/34"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-pfwp-8pq4-g7pv"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/alipay/sofa-hessian"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Incomplete List of Disallowed Inputs in SOFA-Hessian"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-25615"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-03T20:15:59Z",
    "severity": "HIGH"
  },
  "details": "Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668.",
  "id": "GHSA-pg6q-9mqp-879x",
  "modified": "2026-02-05T09:31:12Z",
  "published": "2026-02-03T21:31:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25615"
    },
    {
      "type": "WEB",
      "url": "https://www.blesta.com/2026/01/28/security-advisory"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2026/Feb/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-8804"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-05-07T18:29:00Z",
    "severity": "HIGH"
  },
  "details": "** DISPUTED ** The xdr_bytes and xdr_string functions in the GNU C Library (aka glibc or libc6) 2.25 mishandle failures of buffer deserialization, which allows remote attackers to cause a denial of service (virtual memory allocation, or memory consumption if an overcommit setting is not used) via a crafted UDP packet to port 111, a related issue to CVE-2017-8779. NOTE: [Information provided from upstream and references]",
  "id": "GHSA-pgff-5mf5-cw73",
  "modified": "2022-05-13T01:18:05Z",
  "published": "2022-05-13T01:18:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8804"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1037559#c7"
    },
    {
      "type": "WEB",
      "url": "https://seclists.org/oss-sec/2017/q2/228"
    },
    {
      "type": "WEB",
      "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=21461"
    },
    {
      "type": "WEB",
      "url": "https://sourceware.org/legacy-ml/libc-alpha/2017-05/msg00128.html"
    },
    {
      "type": "WEB",
      "url": "https://sourceware.org/legacy-ml/libc-alpha/2017-05/msg00129.html"
    },
    {
      "type": "WEB",
      "url": "https://sourceware.org/ml/libc-alpha/2017-05/msg00105.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00026.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00039.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00049.html"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2017/05/05/2"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/98339"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "inspiremusic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.0.1.dev0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-5148"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-27T19:48:29Z",
    "nvd_published_at": "2025-05-25T12:15:20Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in FunAudioLLM InspireMusic up to bf32364bcb0d136497ca69f9db622e9216b029dd. It has been classified as critical. Affected is the function load_state_dict of the file inspiremusic/cli/model.py of the component Pickle Data Handler. The manipulation leads to deserialization. An attack has to be approached locally. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is 784cbf8dde2cf1456ff808aeba23177e1810e7a9. It is recommended to apply a patch to fix this issue.",
  "id": "GHSA-pgp9-g5q8-j3wp",
  "modified": "2025-05-27T19:48:29Z",
  "published": "2025-05-25T12:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5148"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FunAudioLLM/InspireMusic/issues/53"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FunAudioLLM/InspireMusic/issues/53#issuecomment-2866688220"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FunAudioLLM/InspireMusic/commit/784cbf8dde2cf1456ff808aeba23177e1810e7a9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/FunAudioLLM/InspireMusic"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.310236"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.310236"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.573800"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "FunAudioLLM InspireMusic deserialization vulnerability"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "vllm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-9052"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-21T03:30:38Z",
    "nvd_published_at": "2025-03-20T10:15:46Z",
    "severity": "CRITICAL"
  },
  "details": "vllm-project vllm version 0.6.0 contains a vulnerability in the distributed training API. The function vllm.distributed.GroupCoordinator.recv_object() deserializes received object bytes using pickle.loads() without sanitization, leading to a remote code execution vulnerability.\n\n### Maintainer perspective\nNote that vLLM does NOT use the code as described in the report on huntr. The problem only exists if you use these internal APIs in a way that exposes them to a network as described. The vllm team was not involved in the analysis of this report and the decision to assign it a CVE.",
  "id": "GHSA-pgr7-mhp5-fgjp",
  "modified": "2025-04-09T17:02:38Z",
  "published": "2025-03-20T12:32:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9052"
    },
    {
      "type": "WEB",
      "url": "https://github.com/github/advisory-database/pull/5444"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vllm-project/vllm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/blob/32e7db25365415841ebc7c4215851743fbb1bad1/vllm/distributed/parallel_state.py#L480"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/blob/v0.8.1/vllm/distributed/parallel_state.py#L457"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/ea75728f-4efe-4a3d-9f53-33f2c908e9f8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-4451"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-16T07:15:11Z",
    "severity": "MODERATE"
  },
  "details": "The NinjaFirewall plugin for WordPress is vulnerable to Authenticated PHAR Deserialization in versions up to, and including, 4.3.3. This allows authenticated attackers to perform phar deserialization on the server.  This deserialization can allow other plugin or theme exploits if vulnerable software is present (WordPress, and NinjaFirewall).",
  "id": "GHSA-pgv2-9j82-2qcq",
  "modified": "2024-10-16T09:30:31Z",
  "published": "2024-10-16T09:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4451"
    },
    {
      "type": "WEB",
      "url": "https://blog.nintechnet.com/security-issue-fixed-in-ninjafirewall-wp-edition"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1a1fc6c9-50cd-40fd-a777-9eed98aab797?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "orchid/platform"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "14.0.0-alpha4"
            },
            {
              "fixed": "14.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-36825"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-11T22:46:27Z",
    "nvd_published_at": "2023-07-11T18:15:20Z",
    "severity": "CRITICAL"
  },
  "details": "Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards.\n\n### Impact\n\nA vulnerability present starting in version 14.0.0-alpha4 and prior to version 14.5.0 is related to the deserialization of untrusted data from the `_state` query parameter, which can result in remote code execution. This vulnerability is related to the deserialization of untrusted data from the `_state` query parameter, which can result in remote code execution.\n\n### Patches\n\nThe issue has been addressed in version 14.5.0. Users are advised to upgrade their software to this version or any subsequent versions that include the patch. There are no known workarounds.\n\n### Workarounds\n\nIn this case, it is recommended for users to upgrade to the patched version rather than relying on workarounds. Upgrading to the fixed version ensures that the vulnerability is no longer present and provides the best protection against remote code execution\n\n### References\n\nFor more detailed information about this workaround and its effectiveness, users should consult the support channels provided by the software or system developer. They can provide specific guidance on implementing this workaround and any potential limitations or caveats associated with it.\n\n----\n\nThis vulnerability was discovered by Vladislav Gladkiy (Positive Technologies)",
  "id": "GHSA-ph6g-p72v-pc3p",
  "modified": "2023-07-20T14:58:59Z",
  "published": "2023-07-11T22:46:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/orchidsoftware/platform/security/advisories/GHSA-ph6g-p72v-pc3p"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36825"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/orchidsoftware/platform"
    },
    {
      "type": "WEB",
      "url": "https://github.com/orchidsoftware/platform/releases/tag/14.5.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Orchid Deserialization of Untrusted Data vulnerability leads to Remote Code Execution"
}