CWE-502
AllowedDeserialization of Untrusted Data
Abstraction: Base · Status: Draft
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
4800 vulnerabilities reference this CWE, most recent first.
GHSA-RF6R-2C4Q-2VWG
Vulnerability from github – Published: 2020-05-15 18:58 – Updated: 2024-03-15 00:50FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.9.10.3"
},
"package": {
"ecosystem": "Maven",
"name": "com.fasterxml.jackson.core:jackson-databind"
},
"ranges": [
{
"events": [
{
"introduced": "2.9.0"
},
{
"fixed": "2.9.10.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-10968"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": true,
"github_reviewed_at": "2020-04-23T19:30:49Z",
"nvd_published_at": "2020-03-26T13:15:00Z",
"severity": "HIGH"
},
"details": "FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).",
"id": "GHSA-rf6r-2c4q-2vwg",
"modified": "2024-03-15T00:50:18Z",
"published": "2020-05-15T18:58:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10968"
},
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/issues/2662"
},
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/commit/05d7e0e13f43e12db6a51726df12c8b4d8040676"
},
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/commit/08fbfacf89a4a4c026a6227a1b470ab7a13e2e88"
},
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html"
},
{
"type": "WEB",
"url": "https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20200403-0002"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "jackson-databind mishandles the interaction between serialization gadgets and typing"
}
GHSA-RF7W-2MQP-5JR5
Vulnerability from github – Published: 2025-12-18 09:30 – Updated: 2026-01-20 15:32Deserialization of Untrusted Data vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Object Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 6.3.2.
{
"affected": [],
"aliases": [
"CVE-2025-60083"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-18T08:16:08Z",
"severity": "HIGH"
},
"details": "Deserialization of Untrusted Data vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Object Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through \u003c= 6.3.2.",
"id": "GHSA-rf7w-2mqp-5jr5",
"modified": "2026-01-20T15:32:29Z",
"published": "2025-12-18T09:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60083"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/pdf-for-woocommerce/vulnerability/wordpress-pdf-invoice-builder-for-woocommerce-plugin-6-3-2-deserialization-of-untrusted-data-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/pdf-for-woocommerce/vulnerability/wordpress-pdf-invoice-builder-for-woocommerce-plugin-6-3-2-deserialization-of-untrusted-data-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RF88-776R-RCQ9
Vulnerability from github – Published: 2026-03-27 18:33 – Updated: 2026-03-27 18:33Impact
Users of the OAuth2 utilities in Saloon, specifically the AccessTokenAuthenticator class.
Patches
Upgrade to Saloon v4+
Upgrade guide: https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4
Description
The Saloon PHP library used PHP's unserialize() in AccessTokenAuthenticator::unserialize() to restore OAuth token state from cache or storage, with allowed_classes => true. An attacker who can control the serialized string (e.g. by overwriting a cached token file or via another injection) can supply a serialized "gadget" object. When unserialize() runs, PHP instantiates that object and runs its magic methods (__wakeup, __destruct, etc.), leading to object injection. In environments with common dependencies (e.g. Monolog), this can be chained to remote code execution (RCE). The fix removes PHP serialization from the AccessTokenAuthenticator class requiring users to store and resolve the authenticator manually.
Credits
Saloon thanks @HuajiHD for finding the issue and recommending solutions and @jonpurvis for applying the fix.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "saloonphp/saloon"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33942"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-27T18:33:43Z",
"nvd_published_at": "2026-03-26T01:16:28Z",
"severity": "HIGH"
},
"details": "### Impact\nUsers of the OAuth2 utilities in Saloon, specifically the `AccessTokenAuthenticator` class.\n\n### Patches\nUpgrade to Saloon v4+\n\nUpgrade guide: https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4\n\n### Description\nThe Saloon PHP library used PHP\u0027s unserialize() in AccessTokenAuthenticator::unserialize() to restore OAuth token state from cache or storage, with allowed_classes =\u003e true. An attacker who can control the serialized string (e.g. by overwriting a cached token file or via another injection) can supply a serialized \"gadget\" object. When unserialize() runs, PHP instantiates that object and runs its magic methods (__wakeup, __destruct, etc.), leading to object injection. In environments with common dependencies (e.g. Monolog), this can be chained to remote code execution (RCE). The fix removes PHP serialization from the AccessTokenAuthenticator class requiring users to store and resolve the authenticator manually.\n\n### Credits\nSaloon thanks @HuajiHD for finding the issue and recommending solutions and @jonpurvis for applying the fix.",
"id": "GHSA-rf88-776r-rcq9",
"modified": "2026-03-27T18:33:43Z",
"published": "2026-03-27T18:33:43Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/saloonphp/saloon/security/advisories/GHSA-rf88-776r-rcq9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33942"
},
{
"type": "WEB",
"url": "https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4"
},
{
"type": "PACKAGE",
"url": "https://github.com/saloonphp/saloon"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "Saloon has insecure deserialization in AccessTokenAuthenticator"
}
GHSA-RF8F-HQJV-986P
Vulnerability from github – Published: 2022-05-24 16:48 – Updated: 2023-07-31 20:21In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution. NOTE: this issue is a bypass for a CVE-2017-18357 whitelist patch.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "shopware/shopware"
},
"ranges": [
{
"events": [
{
"introduced": "5.3.0"
},
{
"last_affected": "5.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-12799"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-31T20:21:38Z",
"nvd_published_at": "2019-06-13T20:29:00Z",
"severity": "HIGH"
},
"details": "In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution. NOTE: this issue is a bypass for a CVE-2017-18357 whitelist patch.",
"id": "GHSA-rf8f-hqjv-986p",
"modified": "2023-07-31T20:21:38Z",
"published": "2022-05-24T16:48:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12799"
},
{
"type": "WEB",
"url": "https://github.com/rapid7/metasploit-framework/pull/11828"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-6m27-7cqj-2mxw"
},
{
"type": "PACKAGE",
"url": "https://github.com/shopware5/shopware"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20171112153855/https://blog.ripstech.com/2017/shopware-php-object-instantiation-to-blind-xxe"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Shopware Insecure Deserialization Vulnerability"
}
GHSA-RF9M-PW9R-XJJ5
Vulnerability from github – Published: 2022-05-13 01:43 – Updated: 2022-05-13 01:43In writeToParcel and readFromParcel of OutputConfiguration.java, there is a permission bypass due to mismatched serialization. This could lead to a local escalation of privilege where the user can start an activity with system privileges, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 8.0, 8.1. Android ID: A-69683251.
{
"affected": [],
"aliases": [
"CVE-2017-13286"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-04T16:29:00Z",
"severity": "HIGH"
},
"details": "In writeToParcel and readFromParcel of OutputConfiguration.java, there is a permission bypass due to mismatched serialization. This could lead to a local escalation of privilege where the user can start an activity with system privileges, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 8.0, 8.1. Android ID: A-69683251.",
"id": "GHSA-rf9m-pw9r-xjj5",
"modified": "2022-05-13T01:43:09Z",
"published": "2022-05-13T01:43:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-13286"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2018-04-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RFX6-VP9G-RH7V
Vulnerability from github – Published: 2018-10-18 17:42 – Updated: 2024-03-01 21:35FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.fasterxml.jackson.core:jackson-databind"
},
"ranges": [
{
"events": [
{
"introduced": "2.9.0"
},
{
"fixed": "2.9.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.fasterxml.jackson.core:jackson-databind"
},
"ranges": [
{
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.fasterxml.jackson.core:jackson-databind"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.9.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-17485"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:54:38Z",
"nvd_published_at": "2018-01-10T18:29:00Z",
"severity": "CRITICAL"
},
"details": "FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.",
"id": "GHSA-rfx6-vp9g-rh7v",
"modified": "2024-03-01T21:35:57Z",
"published": "2018-10-18T17:42:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17485"
},
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/issues/1855"
},
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/commit/10fe7f17ea7c8da2a71e7a0c774b420a1d5c1b50"
},
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/commit/2235894210c75f624a3d0cd60bfb0434a20a18bf"
},
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/commit/459107dccc9b3ea991af3e6ad0953e54b01ef7c1"
},
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/commit/4f16f67ebd22c7522fdbb8a7eb87e3026a807d61"
},
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/commit/978798382ceb72229e5036aa1442943933d6d171"
},
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/commit/f031f27a31625d07922bdd090664c69544200a5d"
},
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/commit/eb217dd0f87c5fb471e0668575644aa7eba9a3d3"
},
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/commit/bb45fb16709018842f858f1a6e1118676aaa34bd"
},
{
"type": "PACKAGE",
"url": "https://github.com/FasterXML/jackson-databind"
},
{
"type": "WEB",
"url": "https://github.com/irsl/jackson-rce-via-spel"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20180201-0003"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03902en_us"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200927162225/http://www.securityfocus.com/archive/1/541652/100/0/threaded"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4114"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0116"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0342"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0478"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0479"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0480"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0481"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1447"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1448"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1449"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1450"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1451"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2930"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:1782"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:1797"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2858"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3149"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3892"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass"
}
GHSA-RFXJ-VG5Q-9QC2
Vulnerability from github – Published: 2025-11-21 00:30 – Updated: 2025-11-21 00:30Microsoft SharePoint Online Elevation of Privilege Vulnerability
{
"affected": [],
"aliases": [
"CVE-2025-59245"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-20T23:15:52Z",
"severity": "CRITICAL"
},
"details": "Microsoft SharePoint Online Elevation of Privilege Vulnerability",
"id": "GHSA-rfxj-vg5q-9qc2",
"modified": "2025-11-21T00:30:22Z",
"published": "2025-11-21T00:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59245"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59245"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RG32-M3HF-772V
Vulnerability from github – Published: 2019-07-16 00:41 – Updated: 2023-08-29 15:29Slanger 0.6.0 is affected by Remote Code Execution (RCE). The impact is A remote attacker can execute arbitrary commands by sending a crafted request to the server. The component is Message handler & request validator. The attack vector is Remote unauthenticated. The fixed version is after commit 5267b455caeb2e055cccf0d2b6a22727c111f5c3.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "slanger"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.6.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-1010306"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": true,
"github_reviewed_at": "2019-07-15T21:51:37Z",
"nvd_published_at": "2019-07-15T15:15:00Z",
"severity": "CRITICAL"
},
"details": "Slanger 0.6.0 is affected by Remote Code Execution (RCE). The impact is A remote attacker can execute arbitrary commands by sending a crafted request to the server. The component is Message handler \u0026 request validator. The attack vector is Remote unauthenticated. The fixed version is after commit 5267b455caeb2e055cccf0d2b6a22727c111f5c3.",
"id": "GHSA-rg32-m3hf-772v",
"modified": "2023-08-29T15:29:43Z",
"published": "2019-07-16T00:41:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1010306"
},
{
"type": "WEB",
"url": "https://github.com/stevegraham/slanger/pull/238"
},
{
"type": "WEB",
"url": "https://github.com/stevegraham/slanger/pull/238/commits/5267b455caeb2e055cccf0d2b6a22727c111f5c3"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/slanger/CVE-2019-1010306.yml"
},
{
"type": "PACKAGE",
"url": "https://github.com/stevegraham/slanger"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Slanger Arbitrary command execution"
}
GHSA-RG8P-9RPG-R32P
Vulnerability from github – Published: 2026-05-26 15:32 – Updated: 2026-06-03 21:30Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.
{
"affected": [],
"aliases": [
"CVE-2026-45247"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-26T15:16:39Z",
"severity": "CRITICAL"
},
"details": "Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP\u0027s native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.",
"id": "GHSA-rg8p-9rpg-r32p",
"modified": "2026-06-03T21:30:25Z",
"published": "2026-05-26T15:32:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45247"
},
{
"type": "WEB",
"url": "https://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer"
},
{
"type": "WEB",
"url": "https://sansec.io/research/mirasvit-cache-warmer-object-injection"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45247"
},
{
"type": "WEB",
"url": "https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-45247-in-mirasvit-full-page-cache-warmer-for-magento"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/mirasvit-cache-warmer-for-magento-php-object-injection"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-RGG3-PRC9-59MW
Vulnerability from github – Published: 2024-03-28 06:30 – Updated: 2025-05-29 21:31Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.26.
{
"affected": [],
"aliases": [
"CVE-2024-30223"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-28T05:15:50Z",
"severity": "CRITICAL"
},
"details": "Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.26.",
"id": "GHSA-rgg3-prc9-59mw",
"modified": "2025-05-29T21:31:32Z",
"published": "2024-03-28T06:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30223"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/armember-membership/wordpress-armember-plugin-4-0-26-unauthenticated-php-object-injection-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
Mitigation
When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
Mitigation
Explicitly define a final object() to prevent deserialization.
Mitigation
- Make fields transient to protect them from deserialization.
- An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.
Mitigation
Avoid having unnecessary types or gadgets (a sequence of instances and method invocations that can self-execute during the deserialization process, often found in libraries) available that can be leveraged for malicious ends. This limits the potential for unintended or unauthorized types and gadgets to be leveraged by the attacker. Add only acceptable classes to an allowlist. Note: new gadgets are constantly being discovered, so this alone is not a sufficient mitigation.
Mitigation
Employ cryptography of the data or code for protection. However, it's important to note that it would still be client-side security. This is risky because if the client is compromised then the security implemented on the client (the cryptography) can be bypassed.
Mitigation MIT-29
Strategy: Firewall
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
CAPEC-586: Object Injection
An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects. Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.