Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (3833 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2025-31430 1 Wordpress 1 Wordpress 2025-07-12 9.8 Critical
Deserialization of Untrusted Data vulnerability in themeton The Business allows Object Injection. This issue affects The Business: from n/a through 1.6.1.
CVE-2025-32293 1 Wordpress 1 Wordpress 2025-07-12 8.8 High
Deserialization of Untrusted Data vulnerability in designthemes Finance Consultant allows Object Injection. This issue affects Finance Consultant: from n/a through 2.8.
CVE-2024-10932 1 Wordpress 1 Wordpress 2025-07-12 8.8 High
The Backup Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.6 via deserialization of untrusted input in the 'recursive_unserialize_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must create a staging site in order to trigger the exploit.
CVE-2025-49073 1 Wordpress 1 Wordpress 2025-07-12 9.8 Critical
Deserialization of Untrusted Data vulnerability in Axiomthemes Sweet Dessert allows Object Injection.This issue affects Sweet Dessert: from n/a before 1.1.13.
CVE-2025-31069 1 Wordpress 1 Wordpress 2025-07-12 9.8 Critical
Deserialization of Untrusted Data vulnerability in themeton HotStar – Multi-Purpose Business Theme allows Object Injection. This issue affects HotStar – Multi-Purpose Business Theme: from n/a through 1.4.
CVE-2024-12312 1 Wordpress 1 Wordpress 2025-07-12 8.1 High
The Print Science Designer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.152 via deserialization of untrusted input through the 'designer-saved-projects' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVE-2025-48287 1 Wordpress 1 Wordpress 2025-07-12 9.8 Critical
Deserialization of Untrusted Data vulnerability in Pagaleve Pix 4x sem juros - Pagaleve allows Object Injection.This issue affects Pix 4x sem juros - Pagaleve: from n/a through 1.6.9.
CVE-2025-31612 1 Wordpress 1 Wordpress 2025-07-12 9.8 Critical
Deserialization of Untrusted Data vulnerability in Sabuj Kundu CBX Poll allows Object Injection. This issue affects CBX Poll: from n/a through 1.2.7.
CVE-2024-34751 2 Webtoffee, Wordpress 2 Order Export & Order Import For Woocommerce, Wordpress 2025-07-12 4.4 Medium
Deserialization of Untrusted Data vulnerability in WebToffee Order Export & Order Import for WooCommerce.This issue affects Order Export & Order Import for WooCommerce: from n/a through 2.4.9.
CVE-2024-49222 1 Wordpress 1 Wordpress 2025-07-12 9.8 Critical
Deserialization of Untrusted Data vulnerability in Amento Tech Pvt ltd WPGuppy allows Object Injection.This issue affects WPGuppy: from n/a through 1.1.0.
CVE-2025-32284 1 Wordpress 1 Wordpress 2025-07-12 8.8 High
Deserialization of Untrusted Data vulnerability in designthemes Pet World allows Object Injection. This issue affects Pet World: from n/a through 2.8.
CVE-2025-26885 1 Wordpress 1 Wordpress 2025-07-12 7.2 High
Deserialization of Untrusted Data vulnerability in Brent Jett Assistant allows Object Injection. This issue affects Assistant: from n/a through 1.5.1.
CVE-2024-56068 1 Wordpress 1 Wordpress 2025-07-12 7.5 High
Deserialization of Untrusted Data vulnerability in Azzaroco WP SuperBackup.This issue affects WP SuperBackup: from n/a through 2.3.3.
CVE-2025-27301 1 Wordpress 1 Wordpress 2025-07-12 7.2 High
Deserialization of Untrusted Data vulnerability in Nazmul Hasan Robin NHR Options Table Manager allows Object Injection. This issue affects NHR Options Table Manager: from n/a through 1.1.2.
CVE-2025-26873 1 Wordpress 1 Wordpress 2025-07-12 9 Critical
Deserialization of Untrusted Data vulnerability in Shine theme Traveler.This issue affects Traveler: from n/a before 3.2.1.
CVE-2024-50507 1 Wordpress 1 Wordpress 2025-07-12 9.8 Critical
Deserialization of Untrusted Data vulnerability in Daniel Schmitzer DS.DownloadList allows Object Injection.This issue affects DS.DownloadList: from n/a through 1.3.
CVE-2024-12687 1 Plextrac 1 Plextrac 2025-07-12 N/A
Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes. This issue affects PlexTrac: from 1.61.3 before 2.8.1.
CVE-2025-39358 1 Wordpress 1 Wordpress 2025-07-12 8.8 High
Deserialization of Untrusted Data vulnerability in Teastudio.Pl WP Posts Carousel allows Object Injection.This issue affects WP Posts Carousel: from n/a through 1.3.12.
CVE-2025-31924 1 Wordpress 1 Wordpress 2025-07-12 8.8 High
Deserialization of Untrusted Data vulnerability in designthemes Crafts & Arts allows Object Injection. This issue affects Crafts & Arts: from n/a through 2.5.
CVE-2024-37361 1 Hitachi 1 Vantara Pentaho Business Analytics Server 2025-07-12 9.9 Critical
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. (CWE-502)   Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes and methods.   When developers place no restrictions on "gadget chains," or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions.