Weaknesses of type CWE-502

2,665 results

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados serializados (JSON, XML, binário) recebidos de fontes externas sem validar adequadamente se o conteúdo é legítimo. Um atacante pode injetar código malicioso ou objetos especialmente crafted que são executados durante a desserialização, comprometendo toda a aplicação.

Example

Um servidor Java desserializa objetos recebidos em requisições HTTP usando ObjectInputStream, sem verificar a classe ou origem dos dados. Um atacante envia um objeto serializado contendo uma cadeia de gadgets (RCE via biblioteca como Apache Commons Collections) que é executada assim que o objeto é reconstruído em memória.

How to mitigate

Valide e liste explicitamente as classes que podem ser desserializadas (whitelist). Para JSON/XML, use parsers que não executem código (como JSON simples, evite eval). Considere alternativas seguras como Protocol Buffers ou MessagePack, e mantenha bibliotecas críticas atualizadas.

CVE-2026-5127HIGHUser Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Authenticated (Subscriber+) PHP Object InjectionEPSS 1.3%CVE-2025-7384CRITICALDatabase for Contact Form 7, WPforms, Elementor forms <= 1.4.3 - Unauthenticated PHP Object Injection to Arbitrary File DeletionEPSS 1.3%CVE-2021-28254CRITICALA deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands.EPSS 1.3%CVE-2023-38155HIGHAzure DevOps Server Remote Code Execution VulnerabilityEPSS 1.3%CVE-2023-24997CRITICALApache InLong: Jdbc Connection Security BypassEPSS 1.3%CVE-2026-41316HIGHERB has an @_init deserialization guard bypass via def_module / def_method / def_classEPSS 1.3%CVE-2026-0764CRITICALGPT Academic upload Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 1.3%CVE-2026-0760CRITICALFoundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 1.3%CVE-2026-0763CRITICALGPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 1.3%CVE-2026-26333CRITICALCalero VeraSMART < 2022 R1 .NET Remoting Arbitrary File Read Leading to ViewState RCEEPSS 1.3%CVE-2021-21865HIGHA unsafe deserialization vulnerability exists in the PackageManagement.plugin ExtensionMethods.Clone() functionality of CODESYS GmbH CODESYSEPSS 1.3%CVE-2021-3035MEDIUMBridgecrew Checkov: Unsafe deserialization of Terraform files allows code executionEPSS 1.3%CVE-2023-51641CRITICALAllegra renderFieldMatch Deserialization of Unstrusted Data Remote Code Execution VulnerabilityEPSS 1.3%CVE-2021-3040MEDIUMBridgecrew Checkov: Unsafe deserialization of Terraform files allows code executionEPSS 1.3%CVE-2023-51642CRITICALAllegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 1.3%CVE-2026-81385HIGHMicrosoft Office Publisher Remote Code Execution VulnerabilityEPSS 1.3%CVE-2024-49147CRITICALMicrosoft Update Catalog Elevation of Privilege VulnerabilityEPSS 1.3%CVE-2023-51389CRITICALHertzBeat SnakeYAML Deser RCEEPSS 1.3%CVE-2025-58782MEDIUMApache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactoryEPSS 1.3%CVE-2026-53805CRITICALNVIDIA SIL GEN3C Unauthenticated RCE via Pickle Deserialization in Inference APIEPSS 1.3%