Weaknesses of type CWE-470

131 results

Reflexão insegura com entrada externa

Ocorre quando a aplicação usa dados controlados pelo usuário para carregar, instanciar ou invocar classes e métodos via reflexão, sem validação prévia. Um atacante pode então executar código arbitrário ou acessar funcionalidades não intencionadas, porque o desenvolvedor delegou ao usuário a decisão de qual código será rodado.

Example

Um sistema Java recebe um parâmetro 'className' via URL e faz Class.forName(className).newInstance(). Se o usuário enviar o nome de uma classe perigosa do sistema ou uma classe maliciosa em classpath, ela será instanciada e executará lógica não autorizada.

How to mitigate

Mantenha uma whitelist rigorosa de classes permitidas, valide e normalize toda entrada antes de usar em reflexão, e considere usar enums ou constantes em vez de nomes de classe oriundos de entrada externa. Limite as permissões do aplicativo conforme o princípio do menor privilégio.

CVE-2021-21985CRITICALThe vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plEPSS 100.0%KEVCVE-2024-4990HIGHUnsafe Reflection in base Component class in yiisoft/yii2EPSS 80.1%CVE-2024-0200HIGHUnsafe Reflection in Github Enterprise Server leading to Command InjectionEPSS 71.7%CVE-2026-82078CRITICALPaperCut MF/NG: Unsafe Dynamic Class Loading in Database ConnectorEPSS 63.0%KEVCVE-2025-3600HIGHUnsafe Reflection Vulnerability in Telerik UI for ASP.NET AJAXEPSS 26.3%CVE-2025-53693CRITICALHTML Cache Poisoning through Unsafe ReflectionsEPSS 20.3%CVE-2022-41853HIGHRemote code execution in HyperSQL DataBaseEPSS 5.1%CVE-2022-23744—Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection bEPSS 4.6%CVE-2019-10174HIGHA vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application clEPSS 3.1%CVE-2023-33652HIGHSitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the componenEPSS 2.5%CVE-2023-6943CRITICALUse of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocketEPSS 2.1%CVE-2024-28121HIGHReflex arbitrary method call in stimulus_reflexEPSS 1.6%CVE-2026-102094HIGHKiteworks Email Protection Gateway unsafe reflectionEPSS 1.5%CVE-2026-44416CRITICALApache Ranger: Remote Code Execution via Arbitrary Class InstantiationEPSS 1.2%CVE-2026-86792HIGHApache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configurationEPSS 1.2%CVE-2026-58400CRITICALGeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatterEPSS 1.2%CVE-2026-65608HIGHGrav before 2.0.9 Remote Code Execution via FlexDirectoryEPSS 1.1%CVE-2026-33157HIGHCraft CMS: Potential authenticated Remote Code Execution via malicious attached BehaviorEPSS 1.1%CVE-2026-25498HIGHCraft has a potential authenticated Remote Code Execution via malicious attached BehaviorEPSS 1.1%CVE-2026-62379CRITICALOpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallbackEPSS 1.1%