Weaknesses of type CWE-470

131 results

Reflexão insegura com entrada externa

Ocorre quando a aplicação usa dados controlados pelo usuário para carregar, instanciar ou invocar classes e métodos via reflexão, sem validação prévia. Um atacante pode então executar código arbitrário ou acessar funcionalidades não intencionadas, porque o desenvolvedor delegou ao usuário a decisão de qual código será rodado.

Example

Um sistema Java recebe um parâmetro 'className' via URL e faz Class.forName(className).newInstance(). Se o usuário enviar o nome de uma classe perigosa do sistema ou uma classe maliciosa em classpath, ela será instanciada e executará lógica não autorizada.

How to mitigate

Mantenha uma whitelist rigorosa de classes permitidas, valide e normalize toda entrada antes de usar em reflexão, e considere usar enums ou constantes em vez de nomes de classe oriundos de entrada externa. Limite as permissões do aplicativo conforme o princípio do menor privilégio.

CVE-2025-63690CRITICALIn pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management moduEPSS 1.1%CVE-2019-3834MEDIUMIt was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate EPSS 1.0%CVE-2020-7857HIGHA vulnerability of XPlatform could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficEPSS 1.0%CVE-2026-44795HIGHSpinnaker: Non-safe yaml deserialization allowing RCE when using specific typesEPSS 1.0%CVE-2026-46562CRITICALYamcs: Remote Code Execution via Mission Database algorithm overrideEPSS 1.0%CVE-2025-68455HIGHCraft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached BehaviorEPSS 1.0%CVE-2024-6096HIGHUnsafe Deserialization VulnerabilityEPSS 0.9%CVE-2026-63317MEDIUMApache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XMLEPSS 0.9%CVE-2024-8015CRITICALTelerik Report Server Insecure Type ResolutionEPSS 0.8%CVE-2026-55107CRITICALKobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)EPSS 0.8%CVE-2026-55559CRITICALYamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)EPSS 0.8%CVE-2025-12967HIGHAn issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticateEPSS 0.8%CVE-2026-6020HIGHShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST APIEPSS 0.8%CVE-2026-17593HIGHNexus Repository - Arbitrary Class Instantiation via Unsafe Realm ConfigurationEPSS 0.8%CVE-2026-41871CRITICALApache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)EPSS 0.7%CVE-2026-13181HIGHRadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAXEPSS 0.7%CVE-2025-34393CRITICALBarracuda RMM < 2025.1.1 Service Center Insecure Reflection RCEEPSS 0.7%CVE-2026-42027CRITICALApache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoaderEPSS 0.7%CVE-2026-116692CRITICALMLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modulesEPSS 0.7%CVE-2026-115886MEDIUMMLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpointsEPSS 0.7%