Common Weakness Enumeration
CWE-502
AllowedDeserialization of Untrusted Data
Abstraction: Base · Status: Draft
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
5481 vulnerabilities reference this CWE, most recent first.
CVE-2026-96343 (GCVE-0-2026-96343)
Vulnerability from cvelistv5 – Published: 2026-09-30 12:27 – Updated: 2026-09-30 13:27
VLAI
EPSS
VEX
Title
WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability
Summary
Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 13:05 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96343",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T13:05:52.836497Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T13:27:11.041Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "erp",
"product": "WP ERP",
"vendor": "weDevs",
"versions": [
{
"changes": [
{
"at": "1.17.10",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.17.9",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Custom role PHP Object Injection in WP ERP \u003c= 1.17.9 versions."
}
],
"value": "Custom role PHP Object Injection in WP ERP \u003c= 1.17.9 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-586 Object Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T12:27:18.779Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/erp/vulnerability/wordpress-wp-erp-plugin-1-17-9-php-object-injection-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress WP ERP plugin to the latest available version (at least 1.17.10)."
}
],
"value": "Update the WordPress WP ERP plugin to the latest available version (at least 1.17.10)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress WP ERP plugin \u003c= 1.17.9 - PHP Object Injection vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-96343",
"datePublished": "2026-09-30T12:27:18.779Z",
"dateReserved": "2026-09-23T00:18:19.473Z",
"dateUpdated": "2026-09-30T13:27:11.041Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95928 (GCVE-0-2026-95928)
Vulnerability from cvelistv5 – Published: 2026-09-23 01:45 – Updated: 2026-09-23 13:52
VLAI
EPSS
VEX
Title
recommenders-team recommenders Dict Loading mind_iterator.py pickle.load deserialization
Summary
A security flaw has been discovered in recommenders-team recommenders up to 1.2.1. This impacts the function pickle.load of the file recommenders/models/newsrec/io/mind_iterator.py of the component Dict Loading. Performing a manipulation results in deserialization. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 13:50 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/408550 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/408550/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-95928 | third-party-advisory |
| https://vuldb.com/submit/953327 | third-party-advisory |
| https://github.com/recommenders-team/recommenders… | exploitissue-tracking |
| https://github.com/recommenders-team/recommenders/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| recommenders-team | recommenders |
Affected:
1.2.0
Affected: 1.2.1 cpe:2.3:a:recommenders-team:recommenders:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95928",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T13:50:57.392964Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T13:52:54.612Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:recommenders-team:recommenders:*:*:*:*:*:*:*:*"
],
"modules": [
"Dict Loading"
],
"product": "recommenders",
"vendor": "recommenders-team",
"versions": [
{
"status": "affected",
"version": "1.2.0"
},
{
"status": "affected",
"version": "1.2.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "__lbz__ (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in recommenders-team recommenders up to 1.2.1. This impacts the function pickle.load of the file recommenders/models/newsrec/io/mind_iterator.py of the component Dict Loading. Performing a manipulation results in deserialization. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T01:45:16.157Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-408550 | recommenders-team recommenders Dict Loading mind_iterator.py pickle.load deserialization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/408550"
},
{
"name": "VDB-408550 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/408550/cti"
},
{
"name": "CVE-2026-95928 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-95928"
},
{
"name": "Submit #953327 | recommenders-team recommenders 1.2.1 rce",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/953327"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/recommenders-team/recommenders/issues/2368"
},
{
"tags": [
"product"
],
"url": "https://github.com/recommenders-team/recommenders/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-22T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-22T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-22T19:24:05.000Z",
"value": "VulDB entry last update"
}
],
"title": "recommenders-team recommenders Dict Loading mind_iterator.py pickle.load deserialization",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-95928",
"datePublished": "2026-09-23T01:45:16.157Z",
"dateReserved": "2026-09-22T17:19:00.142Z",
"dateUpdated": "2026-09-23T13:52:54.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95897 (GCVE-0-2026-95897)
Vulnerability from cvelistv5 – Published: 2026-09-23 00:30 – Updated: 2026-09-23 15:01
VLAI
EPSS
VEX
Title
Dask Loader core.py from_npy_stack deserialization
Summary
A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function from_npy_stack of the file dask/array/core.py of the component Loader. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 15:01 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/408543 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/408543/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-95897 | third-party-advisory |
| https://vuldb.com/submit/953281 | third-party-advisory |
| https://github.com/dask/dask/issues/12578 | exploitissue-tracking |
| https://github.com/dask/dask/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95897",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T15:01:12.785179Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T15:01:52.551Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:dask:dask:*:*:*:*:*:*:*:*"
],
"modules": [
"Loader"
],
"product": "Dask",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "2026.0"
},
{
"status": "affected",
"version": "2026.1"
},
{
"status": "affected",
"version": "2026.2"
},
{
"status": "affected",
"version": "2026.3"
},
{
"status": "affected",
"version": "2026.4"
},
{
"status": "affected",
"version": "2026.5"
},
{
"status": "affected",
"version": "2026.6"
},
{
"status": "affected",
"version": "2026.7"
},
{
"status": "affected",
"version": "2026.8.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "__lbz__ (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function from_npy_stack of the file dask/array/core.py of the component Loader. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T00:30:14.623Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-408543 | Dask Loader core.py from_npy_stack deserialization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/408543"
},
{
"name": "VDB-408543 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/408543/cti"
},
{
"name": "CVE-2026-95897 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-95897"
},
{
"name": "Submit #953281 | dask \u22642026.8.0 rce",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/953281"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/dask/dask/issues/12578"
},
{
"tags": [
"product"
],
"url": "https://github.com/dask/dask/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-22T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-22T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-22T19:12:19.000Z",
"value": "VulDB entry last update"
}
],
"title": "Dask Loader core.py from_npy_stack deserialization",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-95897",
"datePublished": "2026-09-23T00:30:14.623Z",
"dateReserved": "2026-09-22T17:07:14.182Z",
"dateUpdated": "2026-09-23T15:01:52.551Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95806 (GCVE-0-2026-95806)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:09 – Updated: 2026-09-22 15:54
VLAI
EPSS
VEX
Title
MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths
Summary
MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point.
The phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences:
- any filesystem operation on a caller-influenced path that resolves to a phar archive triggers an implicit unserialize() call, creating a deserialization sink;
- a relocated application root can reach executable code inside an uploaded phar file, enabling arbitrary code execution as the web user.
No component of MISP, the vendored CakePHP framework, or any runtime-loaded library reads or constructs phar archives. The wrapper therefore serves no legitimate purpose in the MISP runtime and exists solely as an available primitive for an attacker who can influence a filesystem path argument.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:53 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/08fa755b6 | patch |
GCVE extensions
AI-generated
Human-reviewed
Confidence: medium
Model
qwen3.8:27b
advisory
bcp-05-x-01bcp-05-x-02
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
- Generator
-
patch2vuln.pyon 2026-09-22 15:01 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/08fa755b6.patch
f4fc3223e642… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
08fa755b6363
|
chg: [internal] Unregister the phar stream wrapper in the | f4fc3223e642… |
Fix summary
The phar stream wrapper is unregistered via stream_wrapper_unregister('phar') at the top of both the web and console entry points, before any framework bootstrap or application code executes. Because no MISP component, CakePHP, or runtime library requires the phar wrapper, removing it eliminates the implicit unserialize() sink and the directory-like phar archive behavior without functional impact. This closes the deserialization and code-execution primitive application-wide, independent of whether individual callers validate their path arguments.
Patch summary
Two files are modified. In app/Console/cake.php and app/webroot/index.php, a 14-line block is inserted immediately after the file header comment and before any existing logic. The block checks whether 'phar' is present in stream_get_wrappers() and, if so, calls stream_wrapper_unregister('phar'). A docblock comment explains the security rationale: the wrapper turns filesystem calls on caller-influenced paths into unserialize() sinks and allows a relocated application root to reach code inside an uploaded file. No other code is changed; the total diff is 28 insertions across the two files.
CVSS rationale
AV:N: The vulnerability is reachable through the web entry point (app/webroot/index.php), making it network-accessible. AC:H: Exploitation requires crafting a valid phar archive with a malicious serialized payload and identifying a code path where a caller-influenced filesystem argument resolves to that archive; the commit describes this as an 'argument-injection exploit,' implying non-trivial path manipulation. AT:N: No specific attack-target conditions are indicated. PR:L: MISP is a threat-intelligence platform that typically requires authenticated access; the commit references 'the web user' context, suggesting the attacker operates within the application's privilege boundary. UI:N: No user interaction is required. VC/VI/VA:H: Successful exploitation results in arbitrary code execution as the web user, compromising confidentiality, integrity, and availability of the MISP instance. SC/SI/SA:N: No evidence of impact on subsequent or other components beyond the MISP instance itself.
Weakness rationale
- CWE-502 The phar stream wrapper causes PHP to invoke unserialize() implicitly whenever a filesystem operation resolves to a phar archive. An attacker who can influence the path argument (e.g., via argument injection) can supply a crafted phar file, triggering deserialization of attacker-controlled data and leading to code execution. This is the primary and most specific weakness.
- CWE-74 The phar stream wrapper is a special element of the PHP runtime that was not neutralized (unregistered) in the MISP entry points. Its presence allows downstream filesystem calls to be subverted into deserialization sinks. This is a secondary, broader characterization of the same issue.
Attack pattern rationale
- CAPEC-570 The core attack mechanism is that the phar stream wrapper turns a filesystem call on a caller-influenced path into an implicit unserialize() invocation. An attacker crafts a phar archive containing a malicious serialized payload and causes the application to perform a filesystem operation on that path, triggering deserialization and code execution. CAPEC-570 is the closest match. Uncertainty: the exact injection vector (which specific MISP endpoint or console command accepts the path) is not detailed in the patch, but the deserialization sink is explicitly described in the commit message.
- CAPEC-100 The phar stream wrapper is a trusted, built-in PHP component that the attacker leverages in the MISP runtime environment where it serves no legitimate purpose. The attacker does not need to exploit a flaw in the wrapper itself; rather, its mere presence in the runtime provides the primitive. This is a secondary mapping; CAPEC-570 is preferred as the primary because it more precisely describes the deserialization mechanism.
Assumptions to verify
- The affected version range is inferred from the tag_version_boundary (v2.5.47, 42 commits after fix), suggesting the fix is included in v2.5.47 and earlier versions are affected. The explicit context lists affected_version and fixed_version as null, so the exact boundary is uncertain.
- PR:L is assumed because MISP is an authenticated threat-intelligence platform; however, the patch does not explicitly state whether the vulnerable code path requires authentication. If the argument-injection vector is reachable unauthenticated, PR should be N.
- AC:H is assumed because crafting a valid phar archive and identifying the correct code path for the filesystem call is non-trivial; the commit describes it as an 'argument-injection exploit,' implying specific conditions must be met.
- The CAPEC-570 mapping is based on the commit message's explicit description of the phar wrapper as an 'unserialize() sink'; the exact MISP endpoint or console command that accepts the attacker-influenced path is not identified in the patch.
- The commit message references 'the job-argument guard reverted,' implying a prior guard existed and was removed, making the phar wrapper the remaining defense. The exact prior guard is not described in this patch.
- The Co-Authored-By line lists 'Claude Opus 5 (1M context)' as a co-author; this is recorded in the metadata as a remediation developer but is an AI assistant, not a human contributor. It is excluded from credits to avoid attributing a CVE credit to a non-human entity.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
4 | 9 | medium | 6 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95806",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:53:57.690631Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:54:08.956Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"app/Console/cake.php",
"app/webroot/index.php"
],
"product": "MISP",
"programFiles": [
"app/Console/cake.php",
"app/webroot/index.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.47",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP ships with PHP\u0027s phar stream wrapper registered in both its web entry point and its console entry point.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThe phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences:\u0026nbsp;\u2003\u003c/p\u003e\u2003-\u0026nbsp;any filesystem operation on a caller-influenced path that resolves to a phar archive triggers an implicit unserialize() call, creating a deserialization sink;\u003cbr\u003e\u003cdiv\u003e\u2003-\u0026nbsp;a relocated application root can reach executable code inside an uploaded phar file, enabling arbitrary code execution as the web user.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cp\u003eNo component of MISP, the vendored CakePHP framework, or any runtime-loaded library reads or constructs phar archives. The wrapper therefore serves no legitimate purpose in the MISP runtime and exists solely as an available primitive for an attacker who can influence a filesystem path argument.\u0026nbsp;\u003c/p\u003e"
}
],
"value": "MISP ships with PHP\u0027s phar stream wrapper registered in both its web entry point and its console entry point.\u00a0\n\nThe phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences:\u00a0\u2003\n\n\u2003-\u00a0any filesystem operation on a caller-influenced path that resolves to a phar archive triggers an implicit unserialize() call, creating a deserialization sink;\n\u2003-\u00a0a relocated application root can reach executable code inside an uploaded phar file, enabling arbitrary code execution as the web user.\n\n\n\n\nNo component of MISP, the vendored CakePHP framework, or any runtime-loaded library reads or constructs phar archives. The wrapper therefore serves no legitimate purpose in the MISP runtime and exists solely as an available primitive for an attacker who can influence a filesystem path argument."
}
],
"impacts": [
{
"capecId": "CAPEC-570",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-570 Deserialization of Untrusted Data"
}
]
},
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Leveraging Trusted Components in an Untrusted Environment"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:09:09.738Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/08fa755b6"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe phar stream wrapper is unregistered via stream_wrapper_unregister(\u0027phar\u0027) at the top of both the web and console entry points, before any framework bootstrap or application code executes. Because no MISP component, CakePHP, or runtime library requires the phar wrapper, removing it eliminates the implicit unserialize() sink and the directory-like phar archive behavior without functional impact. This closes the deserialization and code-execution primitive application-wide, independent of whether individual callers validate their path arguments.\u003c/p\u003e"
}
],
"value": "The phar stream wrapper is unregistered via stream_wrapper_unregister(\u0027phar\u0027) at the top of both the web and console entry points, before any framework bootstrap or application code executes. Because no MISP component, CakePHP, or runtime library requires the phar wrapper, removing it eliminates the implicit unserialize() sink and the directory-like phar archive behavior without functional impact. This closes the deserialization and code-execution primitive application-wide, independent of whether individual callers validate their path arguments."
}
],
"title": "MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version range is inferred from the tag_version_boundary (v2.5.47, 42 commits after fix), suggesting the fix is included in v2.5.47 and earlier versions are affected. The explicit context lists affected_version and fixed_version as null, so the exact boundary is uncertain.",
"PR:L is assumed because MISP is an authenticated threat-intelligence platform; however, the patch does not explicitly state whether the vulnerable code path requires authentication. If the argument-injection vector is reachable unauthenticated, PR should be N.",
"AC:H is assumed because crafting a valid phar archive and identifying the correct code path for the filesystem call is non-trivial; the commit describes it as an \u0027argument-injection exploit,\u0027 implying specific conditions must be met.",
"The CAPEC-570 mapping is based on the commit message\u0027s explicit description of the phar wrapper as an \u0027unserialize() sink\u0027; the exact MISP endpoint or console command that accepts the attacker-influenced path is not identified in the patch.",
"The commit message references \u0027the job-argument guard reverted,\u0027 implying a prior guard existed and was removed, making the phar wrapper the remaining defense. The exact prior guard is not described in this patch.",
"The Co-Authored-By line lists \u0027Claude Opus 5 (1M context)\u0027 as a co-author; this is recorded in the metadata as a remediation developer but is an AI assistant, not a human contributor. It is excluded from credits to avoid attributing a CVE credit to a non-human entity."
],
"capecRationale": [
{
"capecId": "CAPEC-570",
"rationale": "The core attack mechanism is that the phar stream wrapper turns a filesystem call on a caller-influenced path into an implicit unserialize() invocation. An attacker crafts a phar archive containing a malicious serialized payload and causes the application to perform a filesystem operation on that path, triggering deserialization and code execution. CAPEC-570 is the closest match. Uncertainty: the exact injection vector (which specific MISP endpoint or console command accepts the path) is not detailed in the patch, but the deserialization sink is explicitly described in the commit message."
},
{
"capecId": "CAPEC-100",
"rationale": "The phar stream wrapper is a trusted, built-in PHP component that the attacker leverages in the MISP runtime environment where it serves no legitimate purpose. The attacker does not need to exploit a flaw in the wrapper itself; rather, its mere presence in the runtime provides the primitive. This is a secondary mapping; CAPEC-570 is preferred as the primary because it more precisely describes the deserialization mechanism."
}
],
"commit": "08fa755b6363ec0b7194d97ea36800ae8eb8f919",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"cvssRationale": "AV:N: The vulnerability is reachable through the web entry point (app/webroot/index.php), making it network-accessible. AC:H: Exploitation requires crafting a valid phar archive with a malicious serialized payload and identifying a code path where a caller-influenced filesystem argument resolves to that archive; the commit describes this as an \u0027argument-injection exploit,\u0027 implying non-trivial path manipulation. AT:N: No specific attack-target conditions are indicated. PR:L: MISP is a threat-intelligence platform that typically requires authenticated access; the commit references \u0027the web user\u0027 context, suggesting the attacker operates within the application\u0027s privilege boundary. UI:N: No user interaction is required. VC/VI/VA:H: Successful exploitation results in arbitrary code execution as the web user, compromising confidentiality, integrity, and availability of the MISP instance. SC/SI/SA:N: No evidence of impact on subsequent or other components beyond the MISP instance itself.",
"fixSummary": "The phar stream wrapper is unregistered via stream_wrapper_unregister(\u0027phar\u0027) at the top of both the web and console entry points, before any framework bootstrap or application code executes. Because no MISP component, CakePHP, or runtime library requires the phar wrapper, removing it eliminates the implicit unserialize() sink and the directory-like phar archive behavior without functional impact. This closes the deserialization and code-execution primitive application-wide, independent of whether individual callers validate their path arguments.",
"generatedAt": "2026-09-22T15:01:21.211955Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 9,
"assumptionCount": 6,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 4
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "f4fc3223e6421557e1c03c2182cfaa2b0c17a1a20870c71214708034faf1350f",
"patchSummary": "Two files are modified. In app/Console/cake.php and app/webroot/index.php, a 14-line block is inserted immediately after the file header comment and before any existing logic. The block checks whether \u0027phar\u0027 is present in stream_get_wrappers() and, if so, calls stream_wrapper_unregister(\u0027phar\u0027). A docblock comment explains the security rationale: the wrapper turns filesystem calls on caller-influenced paths into unserialize() sinks and allows a relocated application root to reach code inside an uploaded file. No other code is changed; the total diff is 28 insertions across the two files.",
"patchTruncated": false,
"patches": [
{
"commit": "08fa755b6363ec0b7194d97ea36800ae8eb8f919",
"patchSha256": "f4fc3223e6421557e1c03c2182cfaa2b0c17a1a20870c71214708034faf1350f",
"source": "https://github.com/MISP/MISP/commit/08fa755b6.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/08fa755b6.patch",
"subject": "chg: [internal] Unregister the phar stream wrapper in the"
}
],
"source": "https://github.com/MISP/MISP/commit/08fa755b6.patch",
"subject": "chg: [internal] Unregister the phar stream wrapper in the",
"tagVersionBoundary": {
"commits_after_fix": 42,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.47",
"version": "2.5.47",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-502",
"rationale": "The phar stream wrapper causes PHP to invoke unserialize() implicitly whenever a filesystem operation resolves to a phar archive. An attacker who can influence the path argument (e.g., via argument injection) can supply a crafted phar file, triggering deserialization of attacker-controlled data and leading to code execution. This is the primary and most specific weakness."
},
{
"cweId": "CWE-74",
"rationale": "The phar stream wrapper is a special element of the PHP runtime that was not neutralized (unregistered) in the MISP entry points. Its presence allows downstream filesystem calls to be subverted into deserialization sinks. This is a secondary, broader characterization of the same issue."
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20263"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-95806",
"datePublished": "2026-09-22T15:09:09.738Z",
"dateReserved": "2026-09-22T15:09:04.977Z",
"dateUpdated": "2026-09-22T15:54:08.956Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95603 (GCVE-0-2026-95603)
Vulnerability from cvelistv5 – Published: 2026-09-23 18:14 – Updated: 2026-09-23 19:27
VLAI
EPSS
VEX
Title
WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability
Summary
Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 19:27 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Victor Rodriguez | Reycob Product Import Export |
Affected:
n/a , ≤ 2.3.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95603",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T19:27:03.351380Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T19:27:12.535Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "reycob-product-import-export",
"product": "Reycob Product Import Export",
"vendor": "Victor Rodriguez",
"versions": [
{
"changes": [
{
"at": "2.4.0",
"status": "unaffected"
}
],
"lessThanOrEqual": "2.3.0",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Shop manager PHP Object Injection in Reycob Product Import Export \u003c= 2.3.0 versions."
}
],
"value": "Shop manager PHP Object Injection in Reycob Product Import Export \u003c= 2.3.0 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-586 Object Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T18:14:49.838Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/reycob-product-import-export/vulnerability/wordpress-reycob-product-import-export-plugin-2-3-0-php-object-injection-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Reycob Product Import Export Plugin to the latest available version (at least 2.4.0)."
}
],
"value": "Update the WordPress Reycob Product Import Export Plugin to the latest available version (at least 2.4.0)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress Reycob Product Import Export plugin \u003c= 2.3.0 - PHP Object Injection vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-95603",
"datePublished": "2026-09-23T18:14:49.838Z",
"dateReserved": "2026-09-22T09:18:20.380Z",
"dateUpdated": "2026-09-23T19:27:12.535Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95531 (GCVE-0-2026-95531)
Vulnerability from cvelistv5 – Published: 2026-09-30 12:27 – Updated: 2026-09-30 13:27
VLAI
EPSS
VEX
Title
WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerability
Summary
Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 13:06 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| QuantumCloud | Conversational Forms for ChatBot |
Affected:
n/a , ≤ 1.5.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95531",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T13:06:09.430448Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T13:27:10.632Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "conversational-forms",
"product": "Conversational Forms for ChatBot",
"vendor": "QuantumCloud",
"versions": [
{
"changes": [
{
"at": "1.5.1",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.5.0",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Subscriber PHP Object Injection in Conversational Forms for ChatBot \u003c= 1.5.0 versions."
}
],
"value": "Subscriber PHP Object Injection in Conversational Forms for ChatBot \u003c= 1.5.0 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-586 Object Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T12:27:16.378Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/conversational-forms/vulnerability/wordpress-conversational-forms-for-chatbot-plugin-1-5-0-php-object-injection-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Conversational Forms for ChatBot plugin to the latest available version (at least 1.5.1)."
}
],
"value": "Update the WordPress Conversational Forms for ChatBot plugin to the latest available version (at least 1.5.1)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress Conversational Forms for ChatBot plugin \u003c= 1.5.0 - PHP Object Injection vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-95531",
"datePublished": "2026-09-30T12:27:16.378Z",
"dateReserved": "2026-09-22T08:50:59.929Z",
"dateUpdated": "2026-09-30T13:27:10.632Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94683 (GCVE-0-2026-94683)
Vulnerability from cvelistv5 – Published: 2026-09-30 12:27 – Updated: 2026-09-30 13:27
VLAI
EPSS
VEX
Title
WordPress DesignSetGo plugin <= 2.8.0 - PHP Object Injection vulnerability
Summary
Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 13:06 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Justin Nealey | DesignSetGo |
Affected:
n/a , ≤ 2.8.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94683",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T13:06:14.543107Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T13:27:10.504Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "designsetgo",
"product": "DesignSetGo",
"vendor": "Justin Nealey",
"versions": [
{
"changes": [
{
"at": "2.8.1",
"status": "unaffected"
}
],
"lessThanOrEqual": "2.8.0",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Contributor PHP Object Injection in DesignSetGo \u003c= 2.8.0 versions."
}
],
"value": "Contributor PHP Object Injection in DesignSetGo \u003c= 2.8.0 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-586 Object Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T12:27:15.502Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/designsetgo/vulnerability/wordpress-designsetgo-plugin-2-8-0-php-object-injection-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress DesignSetGo plugin to the latest available version (at least 2.8.1)."
}
],
"value": "Update the WordPress DesignSetGo plugin to the latest available version (at least 2.8.1)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress DesignSetGo plugin \u003c= 2.8.0 - PHP Object Injection vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-94683",
"datePublished": "2026-09-30T12:27:15.502Z",
"dateReserved": "2026-09-22T00:19:50.792Z",
"dateUpdated": "2026-09-30T13:27:10.504Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94678 (GCVE-0-2026-94678)
Vulnerability from cvelistv5 – Published: 2026-09-30 12:27 – Updated: 2026-09-30 13:27
VLAI
EPSS
VEX
Title
WordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerability
Summary
Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 13:06 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mat Lipe | Go Live Update Urls |
Affected:
n/a , ≤ 7.0.8
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94678",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T13:06:24.164363Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T13:27:10.375Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "go-live-update-urls",
"product": "Go Live Update Urls",
"vendor": "Mat Lipe",
"versions": [
{
"changes": [
{
"at": "7.1.0",
"status": "unaffected"
}
],
"lessThanOrEqual": "7.0.8",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Contributor PHP Object Injection in Go Live Update Urls \u003c= 7.0.8 versions."
}
],
"value": "Contributor PHP Object Injection in Go Live Update Urls \u003c= 7.0.8 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-586 Object Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T12:27:13.854Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/go-live-update-urls/vulnerability/wordpress-go-live-update-urls-plugin-7-0-8-php-object-injection-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Go Live Update Urls plugin to the latest available version (at least 7.1.0)."
}
],
"value": "Update the WordPress Go Live Update Urls plugin to the latest available version (at least 7.1.0)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress Go Live Update Urls plugin \u003c= 7.0.8 - PHP Object Injection vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-94678",
"datePublished": "2026-09-30T12:27:13.854Z",
"dateReserved": "2026-09-22T00:19:50.791Z",
"dateUpdated": "2026-09-30T13:27:10.375Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94677 (GCVE-0-2026-94677)
Vulnerability from cvelistv5 – Published: 2026-09-30 12:27 – Updated: 2026-09-30 13:27
VLAI
EPSS
VEX
Title
WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability
Summary
Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 13:06 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Nexcess | Kadence WooCommerce Email Designer |
Affected:
n/a , ≤ 1.5.19.1
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94677",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T13:06:35.516919Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T13:27:09.970Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "kadence-woocommerce-email-designer",
"product": "Kadence WooCommerce Email Designer",
"vendor": "Nexcess",
"versions": [
{
"changes": [
{
"at": "1.5.19.2",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.5.19.1",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Shop manager PHP Object Injection in Kadence WooCommerce Email Designer \u003c= 1.5.19.1 versions."
}
],
"value": "Shop manager PHP Object Injection in Kadence WooCommerce Email Designer \u003c= 1.5.19.1 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-586 Object Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T12:27:13.048Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/kadence-woocommerce-email-designer/vulnerability/wordpress-kadence-woocommerce-email-designer-plugin-1-5-19-1-php-object-injection-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Kadence WooCommerce Email Designer plugin to the latest available version (at least 1.5.19.2)."
}
],
"value": "Update the WordPress Kadence WooCommerce Email Designer plugin to the latest available version (at least 1.5.19.2)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress Kadence WooCommerce Email Designer plugin \u003c= 1.5.19.1 - PHP Object Injection vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-94677",
"datePublished": "2026-09-30T12:27:13.048Z",
"dateReserved": "2026-09-22T00:19:50.791Z",
"dateUpdated": "2026-09-30T13:27:09.970Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94390 (GCVE-0-2026-94390)
Vulnerability from cvelistv5 – Published: 2026-10-01 14:33 – Updated: 2026-10-01 16:03
VLAI
EPSS
VEX
Title
WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.4 - PHP Object Injection vulnerability
Summary
Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 16:03 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dotstore | Hide Shipping Method For WooCommerce |
Affected:
n/a , ≤ 1.5.4
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94390",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T16:03:51.307348Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T16:03:56.330Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "hide-shipping-method-for-woocommerce",
"product": "Hide Shipping Method For WooCommerce",
"vendor": "Dotstore",
"versions": [
{
"changes": [
{
"at": "1.5.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.5.4",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Editor PHP Object Injection in Hide Shipping Method For WooCommerce \u003c= 1.5.4 versions."
}
],
"value": "Editor PHP Object Injection in Hide Shipping Method For WooCommerce \u003c= 1.5.4 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-586 Object Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T14:33:54.882Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/hide-shipping-method-for-woocommerce/vulnerability/wordpress-hide-shipping-method-for-woocommerce-plugin-1-5-4-php-object-injection-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Hide Shipping Method For WooCommerce plugin to the latest available version (at least 1.5.5)."
}
],
"value": "Update the WordPress Hide Shipping Method For WooCommerce plugin to the latest available version (at least 1.5.5)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress Hide Shipping Method For WooCommerce plugin \u003c= 1.5.4 - PHP Object Injection vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-94390",
"datePublished": "2026-10-01T14:33:54.882Z",
"dateReserved": "2026-09-21T13:11:04.426Z",
"dateUpdated": "2026-10-01T16:03:56.330Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Implementation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
Mitigation
Implementation
When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
Mitigation
Implementation
Explicitly define a final object() to prevent deserialization.
Mitigation
Architecture and Design
Implementation
- Make fields transient to protect them from deserialization.
- An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.
Mitigation
Implementation
Avoid having unnecessary types or gadgets (a sequence of instances and method invocations that can self-execute during the deserialization process, often found in libraries) available that can be leveraged for malicious ends. This limits the potential for unintended or unauthorized types and gadgets to be leveraged by the attacker. Add only acceptable classes to an allowlist. Note: new gadgets are constantly being discovered, so this alone is not a sufficient mitigation.
Mitigation
Architecture and Design
Implementation
Employ cryptography of the data or code for protection. However, it's important to note that it would still be client-side security. This is risky because if the client is compromised then the security implemented on the client (the cryptography) can be bypassed.
Mitigation MIT-29
Operation
Strategy: Firewall
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
CAPEC-586: Object Injection
An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects. Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.