Weaknesses of type CWE-470

93 results

Reflexão insegura com entrada externa

Ocorre quando a aplicação usa dados controlados pelo usuário para carregar, instanciar ou invocar classes e métodos via reflexão, sem validação prévia. Um atacante pode então executar código arbitrário ou acessar funcionalidades não intencionadas, porque o desenvolvedor delegou ao usuário a decisão de qual código será rodado.

Example

Um sistema Java recebe um parâmetro 'className' via URL e faz Class.forName(className).newInstance(). Se o usuário enviar o nome de uma classe perigosa do sistema ou uma classe maliciosa em classpath, ela será instanciada e executará lógica não autorizada.

How to mitigate

Mantenha uma whitelist rigorosa de classes permitidas, valide e normalize toda entrada antes de usar em reflexão, e considere usar enums ou constantes em vez de nomes de classe oriundos de entrada externa. Limite as permissões do aplicativo conforme o princípio do menor privilégio.

CVE-2026-46562CRITICALYamcs: Remote Code Execution via Mission Database algorithm overrideEPSS 1.0%CVE-2025-68455HIGHCraft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached BehaviorEPSS 0.9%CVE-2024-6096HIGHUnsafe Deserialization VulnerabilityEPSS 0.9%CVE-2026-65608HIGHGrav before 2.0.9 Remote Code Execution via FlexDirectoryEPSS 0.8%CVE-2024-8015CRITICALTelerik Report Server Insecure Type ResolutionEPSS 0.8%CVE-2026-41871CRITICALApache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)EPSS 0.8%CVE-2026-78030CRITICALDBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBMEPSS 0.7%CVE-2026-42027CRITICALApache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoaderEPSS 0.7%CVE-2025-34393CRITICALBarracuda RMM < 2025.1.1 Service Center Insecure Reflection RCEEPSS 0.7%CVE-2026-41870HIGHApache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)EPSS 0.7%CVE-2026-44416CRITICALApache Ranger: Remote Code Execution via Arbitrary Class InstantiationEPSS 0.7%CVE-2026-62379CRITICALOpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallbackEPSS 0.7%CVE-2023-32217CRITICALSailPoint IdentityIQ Unsafe use of Reflection VulnerabilityEPSS 0.6%CVE-2024-8014HIGHTelerik Reporting EntityDataSource Insecure Type ResolutionEPSS 0.6%CVE-2026-40008CRITICALApache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPCEPSS 0.6%CVE-2026-8178CRITICALRemote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC DriverEPSS 0.6%CVE-2026-76825HIGHRestrictedPython: Sandbox escape via string.Formatter field resolutionEPSS 0.6%CVE-2026-63317MEDIUMApache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XMLEPSS 0.6%CVE-2026-55559CRITICALYamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)EPSS 0.6%CVE-2024-7059HIGHA high-severity vulnerability that can lead to arbitrary code execution on the system hosting the Web SDK role was found in the Genetec SecuEPSS 0.5%