Weaknesses of type CWE-470

131 results

Reflexão insegura com entrada externa

Ocorre quando a aplicação usa dados controlados pelo usuário para carregar, instanciar ou invocar classes e métodos via reflexão, sem validação prévia. Um atacante pode então executar código arbitrário ou acessar funcionalidades não intencionadas, porque o desenvolvedor delegou ao usuário a decisão de qual código será rodado.

Example

Um sistema Java recebe um parâmetro 'className' via URL e faz Class.forName(className).newInstance(). Se o usuário enviar o nome de uma classe perigosa do sistema ou uma classe maliciosa em classpath, ela será instanciada e executará lógica não autorizada.

How to mitigate

Mantenha uma whitelist rigorosa de classes permitidas, valide e normalize toda entrada antes de usar em reflexão, e considere usar enums ou constantes em vez de nomes de classe oriundos de entrada externa. Limite as permissões do aplicativo conforme o princípio do menor privilégio.

CVE-2026-41870HIGHApache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)EPSS 0.7%CVE-2026-79987HIGHLow-privilege RCE through element-search eager loadingEPSS 0.6%CVE-2026-70410HIGHApache Calcite Avatica: Unrestricted class initialization when instantiating pluginsEPSS 0.6%CVE-2023-32217CRITICALSailPoint IdentityIQ Unsafe use of Reflection VulnerabilityEPSS 0.6%CVE-2022-4993CRITICALHTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation templateEPSS 0.6%CVE-2026-58659HIGHPyTorch Lightning Arbitrary Code Execution via _instantiator HyperparameterEPSS 0.6%CVE-2024-8014HIGHTelerik Reporting EntityDataSource Insecure Type ResolutionEPSS 0.6%CVE-2026-76825HIGHRestrictedPython: Sandbox escape via string.Formatter field resolutionEPSS 0.6%CVE-2026-97666MEDIUMNexus Repository 3 - Unsafe Reflection in ExtDirect Repository EndpointEPSS 0.6%CVE-2026-61599HIGHdjust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount pathEPSS 0.6%CVE-2026-8178CRITICALRemote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC DriverEPSS 0.6%CVE-2026-40008CRITICALApache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPCEPSS 0.6%CVE-2026-93762CRITICALData deletion and attribute disclosure via field-name method injection in in-memory queriesEPSS 0.6%CVE-2026-19032MEDIUMjackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.PathEPSS 0.6%CVE-2026-79784HIGHVocos through 0.1.0 Arbitrary Code Execution via Unrestricted class_path in Model ConfigurationEPSS 0.6%CVE-2026-13051CRITICALForm::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to add_error as a Locale::Maketext templateEPSS 0.6%CVE-2026-63337HIGHRabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loadingEPSS 0.6%CVE-2026-119578HIGHMONAI 1.6.0 before 1.6.1 Code Execution via Auto3DSeg algo_from_json()EPSS 0.6%CVE-2024-7059HIGHA high-severity vulnerability that can lead to arbitrary code execution on the system hosting the Web SDK role was found in the Genetec SecuEPSS 0.5%CVE-2026-92415MEDIUMApache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodiesEPSS 0.5%