Content management system written in PHP allows unserialize of arbitrary objects, possibly allowing code execution.
CVE-2011-2520
Python script allows local users to execute code via pickled data.
CVE-2012-4406