Weaknesses of type CWE-470

131 results

Reflexão insegura com entrada externa

Ocorre quando a aplicação usa dados controlados pelo usuário para carregar, instanciar ou invocar classes e métodos via reflexão, sem validação prévia. Um atacante pode então executar código arbitrário ou acessar funcionalidades não intencionadas, porque o desenvolvedor delegou ao usuário a decisão de qual código será rodado.

Example

Um sistema Java recebe um parâmetro 'className' via URL e faz Class.forName(className).newInstance(). Se o usuário enviar o nome de uma classe perigosa do sistema ou uma classe maliciosa em classpath, ela será instanciada e executará lógica não autorizada.

How to mitigate

Mantenha uma whitelist rigorosa de classes permitidas, valide e normalize toda entrada antes de usar em reflexão, e considere usar enums ou constantes em vez de nomes de classe oriundos de entrada externa. Limite as permissões do aplicativo conforme o princípio do menor privilégio.

CVE-2026-32264HIGHCraft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsControllerEPSS 0.5%CVE-2026-10853HIGHIBM MQ queue manager is vulnerable to remote code executionEPSS 0.5%CVE-2025-31119HIGHCWE-470 in generator-jhipster-entity-audit when having Javers selected as Entity Audit FrameworkEPSS 0.5%CVE-2026-54614MEDIUMDebugKit: MailPreview contains unsafe reflectionEPSS 0.5%CVE-2026-34216MEDIUMCtrlPanel: Authenticated Remote Code Execution via Dynamic Class Instantiation in SettingsController.phpEPSS 0.5%CVE-2026-32263HIGHCraft CMS vulnerable to behavior injection RCE via EntryTypesControllerEPSS 0.5%CVE-2024-53850HIGHThe Addressing GLPI plugin allows data enumeration through uncontrolled object instantiationEPSS 0.5%CVE-2024-22258MEDIUMCVE-2024-22258: PKCE Downgrade in Spring Authorization ServerEPSS 0.5%CVE-2026-101292HIGHArtemis-core-client: unsafe reflection in apache activemq artemis federation message deserializationEPSS 0.5%CVE-2026-93765HIGHDocument deletion and process crash via unvalidated method-name dispatch in atomic pop operationEPSS 0.5%CVE-2026-13772HIGHIBM WebSphere eXtreme Scale's OQL is affected by remote code executionEPSS 0.5%CVE-2026-14380HIGHDBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced ProfileEPSS 0.5%CVE-2026-44174HIGHKirby: Arbitrary Method Call via REST API search and collection query endpointsEPSS 0.5%CVE-2026-115931CRITICALArbitrary file read and backend crash through unrestricted provider method callsEPSS 0.5%CVE-2026-8400HIGHMultiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPUEPSS 0.5%CVE-2026-106510HIGHBackstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.ymlEPSS 0.5%CVE-2025-2794HIGHKentico Xperience <= 13.0.180 Unsafe ReflectionEPSS 0.5%CVE-2026-82894—Apache OFBiz: Content renderer runs a service name stored on the rowEPSS 0.5%CVE-2026-73098CRITICALApache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsingEPSS 0.5%CVE-2026-106439HIGHHydra: Mutable instantiate policy sets allow target blocklist bypassEPSS 0.5%