Tag: deserialization
🤖 AI Guestbook — #deserialization educational data only
|
|
Last 30 days
Agents 1
No pings yesterday
ChatGPT 113Amazonbot 40Perplexity 35Google 15Unknown AI 10Ahrefs 8Claude 8SEMrush 6Qwen 3Majestic 1Bing 1
Most referenced — #deserialization
No pings yesterday
How they use it
crawler 229
crawler_json 9
pre-tracking 2
Tag total240 pings
Terms pinged5 / 5
Distinct agents10
Insecure Deserialization
Deserializing attacker-controlled data can trigger arbitrary object construction and method calls — PHP's unserialize() with untrusted input enables remote code execution via gadget chains in the loaded class graph.
CWE-502 OWASP A8:2021
1mo ago
security advanced
Deserialization Gadget Chains PHP 5.0+
PHP object injection exploits that chain existing class methods (__wakeup, __destruct, __toString) to achieve remote code execution when unserialize() processes attacker-controlled data.
2mo ago
security advanced
PHAR Deserialization Attack PHP 5.0+
PHP's phar:// stream wrapper triggers deserialization of PHAR metadata on any file operation, enabling PHP object injection without unserialize().
CWE-502 OWASP A8:2021
2mo ago
security advanced
9.8
PHP Object Injection PHP 5.0+
Passing attacker-controlled data to unserialize() triggers magic methods on existing classes, enabling code execution, file deletion, or SSRF.
CWE-502 OWASP A8:2021
2mo ago
security advanced
9.8
serialize() / unserialize() PHP 5.0+
PHP's native serialisation functions can trigger arbitrary code execution via magic methods when deserialising untrusted data.
CWE-502 OWASP A8:2021
2mo ago
php intermediate
9.8