CWE-502

{
  "affected": [],
  "aliases": [
    "CVE-2021-34992"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-11-15T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS 6.10. Authentication is required to exploit this vulnerability. The specific flaw exists within Composite.dll. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-14740.",
  "id": "GHSA-xr89-j843-vpgq",
  "modified": "2022-05-24T19:20:54Z",
  "published": "2022-05-24T19:20:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34992"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Orckestra/C1-CMS-Foundation/releases/tag/v6.11"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1304"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-9330"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-01T19:16:55Z",
    "severity": "HIGH"
  },
  "details": "IBM WebSphere Application Server 9.0, and 8.5 is affected by an improper validation of user-supplied data during deserialization using the SAML Web Single Sign-On component. This could result in remote code execution via a crafted HTTP request when combined with a suitable gadget chain.",
  "id": "GHSA-xrfh-q76x-p6f2",
  "modified": "2026-06-01T21:30:44Z",
  "published": "2026-06-01T21:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9330"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7274733"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-23450"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-04-12T09:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions \u003c V7.3 Update 1), SIMATIC Energy Manager PRO (All versions \u003c V7.3 Update 1). The affected system allows remote users to send maliciously crafted objects. Due to insecure deserialization of user-supplied content by the affected software, an unauthenticated attacker could exploit this vulnerability by sending a maliciously crafted serialized object. This could allow the attacker to execute arbitrary code on the device with SYSTEM privileges.",
  "id": "GHSA-xrj9-8xhq-9gjh",
  "modified": "2022-04-20T00:00:55Z",
  "published": "2022-04-13T00:00:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23450"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-655554.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-61168"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-25T19:15:50Z",
    "severity": "CRITICAL"
  },
  "details": "An issue in the cms_rest.php component of SIGB PMB v8.0.1.14 allows attackers to execute arbitrary code via unserializing an arbitrary file.",
  "id": "GHSA-xrwq-v96x-p8vf",
  "modified": "2025-11-25T21:32:06Z",
  "published": "2025-11-25T21:32:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61168"
    },
    {
      "type": "WEB",
      "url": "https://forge.sigb.net/projects/pmb/wiki/Changelog_801#S%C3%A9curit%C3%A9-2"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/ZanyMonk/446f6875a2ceb3decef5ff1176428f9e"
    },
    {
      "type": "WEB",
      "url": "http://pmb.com"
    },
    {
      "type": "WEB",
      "url": "http://sigb.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-27852"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-05-27T21:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.",
  "id": "GHSA-xrx4-vq84-23w6",
  "modified": "2025-10-22T00:32:13Z",
  "published": "2022-05-24T19:03:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27852"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27852"
    },
    {
      "type": "WEB",
      "url": "https://www.kb.cert.org/vuls/id/706695"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-23620"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-02T23:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "The Java Remote Management Interface of all versions of Orlansoft ERP was discovered to contain a vulnerability due to insecure deserialization of user-supplied content, which can allow attackers to execute arbitrary code via a crafted serialized Java object.",
  "id": "GHSA-xv2m-fg2f-xrrw",
  "modified": "2022-05-12T00:02:00Z",
  "published": "2022-05-04T00:00:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-23620"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/fuzzKitty/95106430aa09760ebdcfa6304777f31f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/joaomatosf/jexboss"
    },
    {
      "type": "WEB",
      "url": "https://orlansoft.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-1552"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-04-11T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "ToolboxST prior to version 7.10 is affected by a deserialization vulnerability. An attacker with local access to an HMI or who has conducted a social engineering attack on an authorized operator could execute code in a Toolbox user\u0027s context through the deserialization of an untrusted configuration file.\u00a0Two CVSS scores have been provided to capture the differences between the two aforementioned attack vectors.\u00a0\n\nCustomers are advised to update to ToolboxST 7.10 which can be found in ControlST 7.10. If unable to update at this time customers should ensure they are following the guidance laid out in GE Gas Power\u0027s Secure Deployment Guide (GEH-6839). Customers should ensure they are not running ToolboxST as an Administrative user.\u00a0",
  "id": "GHSA-xv45-qm36-h77q",
  "modified": "2024-04-04T05:35:49Z",
  "published": "2023-07-06T19:24:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1552"
    },
    {
      "type": "WEB",
      "url": "https://www.ge.com/content/dam/cyber_security/global/en_US/pdfs/2023-03-23_ToolboxST_Deserialization_of_Untrusted_Configuration_Data.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-39445"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-17T14:17:50Z",
    "severity": "HIGH"
  },
  "details": "Unauthenticated PHP Object Injection in Alukas \u003c 3.0.0 versions.",
  "id": "GHSA-xv4h-3jg8-vf5r",
  "modified": "2026-06-17T18:35:54Z",
  "published": "2026-06-17T18:35:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39445"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/theme/alukas/vulnerability/wordpress-alukas-theme-3-0-0-php-object-injection-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-53990"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-16T11:15:26Z",
    "severity": "HIGH"
  },
  "details": "Deserialization of Untrusted Data vulnerability in jetmonsters JetFormBuilder allows Object Injection. This issue affects JetFormBuilder: from n/a through 3.5.1.2.",
  "id": "GHSA-xv5g-36c6-hqwj",
  "modified": "2026-04-01T18:35:46Z",
  "published": "2025-07-16T12:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53990"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/jetformbuilder/vulnerability/wordpress-jetformbuilder-plugin-3-5-1-2-php-object-injection-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "fugue"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.9.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-62703"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502",
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-11-25T20:39:15Z",
    "nvd_published_at": "2025-11-25T22:15:47Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nThe Fugue framework implements an RPC server system for distributed computing operations. In the core\u00a0functionality of the RPC server implementation, I\u00a0found that\u00a0the\u00a0_decode()\u00a0function in\u00a0fugue/rpc/flask.py\u00a0directly uses\u00a0cloudpickle.loads()\u00a0to deserialize data\u00a0without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC\u00a0server.The vulnerability exists in the RPC communication mechanism where the client can\u00a0send arbitrary serialized Python objects that will be deserialized on the server\u00a0side, allowing\u00a0attackers to\u00a0execute arbitrary code\u00a0on the victim\u0027s machine.\n\n### Details\n_decode()\u00a0function in\u00a0fugue/rpc/flask.py directly uses\u00a0cloudpickle.loads()\u00a0to deserialize data\u00a0without any sanitization.\n\n### PoC\n* Step1:\nThe victim user starts an RPC\u00a0server binding to open network using\u00a0the Fugue framework. Here, I use the\u00a0official RPC\u00a0server code\u00a0to initialize\u00a0the server. \n\n* Step2:\nThe attacker modifies\u00a0the\u00a0_encode()\u00a0function\u00a0in\u00a0fugue/rpc/flask.py\u00a0to\u00a0inject malicious pickle data:\n\n\u003cimg width=\"740\" height=\"260\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6064516b-e1a6-45fa-a91c-8e276bc4a106\" /\u003e\n\nIn this example, attacker modifies _encode to let the victim execute command \u201cls -l\u201d\n\n* Step 3:\nThe attacker then\u00a0uses the RPC client to send\u00a0the malicious\u00a0request\n\nFugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py.  In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py.\n\n\n### Impact\nRemote code execution in the victim\u0027s machine. Once the victim starts\u00a0the RPCServer with network binding (especially\u00a00.0.0.0), an attacker on\u00a0the network\u00a0can gain arbitrary code execution by connecting to the RPCServer\u00a0and sending crafted pickle payloads. This vulnerability allows\u00a0for:\n\n- Complete system compromise\n- Data exfiltration\n- Lateral movement within the network\n- Denial of service attacks\n- Installation of persistent backdoors\n\n### Mitigation\n1. **Replace unsafe deserialization**: Replace `pickle.loads()` with safer alternatives such as:\n   - JSON serialization for simple data structures\n   - Protocol Buffers or MessagePack for complex data\n   - If pickle must be used, implement a custom `Unpickler` with a restricted `find_class()` method that only allows whitelisted classes\n\n2. **Network security**: \n   - If the service is intended for internal use only, bind to localhost (`127.0.0.1`) instead of `0.0.0.0`\n   - Implement authentication and authorization mechanisms\n\n3. **Security warnings**: When starting the service on public interfaces, display clear security warnings to inform users about the risks.\n\nAttachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing",
  "id": "GHSA-xv5p-fjw5-vrj6",
  "modified": "2025-11-27T09:00:39Z",
  "published": "2025-11-25T20:39:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fugue-project/fugue/security/advisories/GHSA-xv5p-fjw5-vrj6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62703"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fugue-project/fugue/commit/6f25326779fd1f528198098d6287c5a863176fc0"
    },
    {
      "type": "WEB",
      "url": "https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fugue-project/fugue"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Fugue is Vulnerable to Remote Code Execution\u00a0by Pickle Deserialization via FlaskRPCServer"
}