Weaknesses of type CWE-502

2,668 results

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados serializados (JSON, XML, binário) recebidos de fontes externas sem validar adequadamente se o conteúdo é legítimo. Um atacante pode injetar código malicioso ou objetos especialmente crafted que são executados durante a desserialização, comprometendo toda a aplicação.

Example

Um servidor Java desserializa objetos recebidos em requisições HTTP usando ObjectInputStream, sem verificar a classe ou origem dos dados. Um atacante envia um objeto serializado contendo uma cadeia de gadgets (RCE via biblioteca como Apache Commons Collections) que é executada assim que o objeto é reconstruído em memória.

How to mitigate

Valide e liste explicitamente as classes que podem ser desserializadas (whitelist). Para JSON/XML, use parsers que não executem código (como JSON simples, evite eval). Considere alternativas seguras como Protocol Buffers ou MessagePack, e mantenha bibliotecas críticas atualizadas.

CVE-2022-33316HIGHDeserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics DigiEPSS 0.3%CVE-2021-4178—A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly EPSS 0.3%CVE-2026-1184MEDIUMDeserialization of Untrusted Data in GitLabEPSS 0.3%CVE-2023-3324MEDIUM Insecure deserialization in zenon internal DLLsEPSS 0.3%CVE-2025-66214HIGHLadybug has an XMLDecoder Deserialization Vulnerability (Java RCE)EPSS 0.3%CVE-2025-11273MEDIUMLaChatterie Verger provider.ts redirectToAuthorization deserializationEPSS 0.3%CVE-2025-14930HIGHHugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 0.3%CVE-2024-4606MEDIUMWordPress Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder plugin <= 2.0.3 - PHP Object Injection vulnerabilityEPSS 0.3%CVE-2024-14021HIGHLlamaIndex <= 0.11.6 BGEM3Index Unsafe DeserializationEPSS 0.3%CVE-2025-14924HIGHHugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-14921HIGHHugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 0.3%CVE-2024-29040MEDIUMFapi Verify Quote: Does not detect if quote was not generated by TPMEPSS 0.3%CVE-2026-24220MEDIUMNVIDIA TensorRT-LLM for any platform contains a vulnerability in visual gen server, where an attacker could cause an unsafe deserialization EPSS 0.3%CVE-2025-48101HIGHWordPress Constant Contact for WordPress Plugin <= 4.1.1 - PHP Object Injection VulnerabilityEPSS 0.3%CVE-2025-34489HIGHGFI MailEssentials < 21.8 Local Privilege EscalationEPSS 0.3%CVE-2025-53572HIGHWordPress WP Easy Contact Plugin <= 4.0.1 - PHP Object Injection VulnerabilityEPSS 0.3%CVE-2025-47579CRITICALWordPress Photography Theme <= 7.7.2 - PHP Object Injection VulnerabilityEPSS 0.3%CVE-2025-53584HIGHWordPress WP Ticket Customer Service Software & Support Ticket System Plugin <= 6.0.2 - PHP Object Injection VulnerabilityEPSS 0.3%CVE-2025-53583HIGHWordPress Employee Spotlight Plugin <= 5.1.1 - PHP Object Injection VulnerabilityEPSS 0.3%CVE-2025-53243HIGHWordPress Employee Directory – Staff Listing & Team Directory plugin for WordPress plugin <= 4.5.5 - PHP Object Injection vulnerabilityEPSS 0.3%