Weaknesses of type CWE-502

2,665 results

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados serializados (JSON, XML, binário) recebidos de fontes externas sem validar adequadamente se o conteúdo é legítimo. Um atacante pode injetar código malicioso ou objetos especialmente crafted que são executados durante a desserialização, comprometendo toda a aplicação.

Example

Um servidor Java desserializa objetos recebidos em requisições HTTP usando ObjectInputStream, sem verificar a classe ou origem dos dados. Um atacante envia um objeto serializado contendo uma cadeia de gadgets (RCE via biblioteca como Apache Commons Collections) que é executada assim que o objeto é reconstruído em memória.

How to mitigate

Valide e liste explicitamente as classes que podem ser desserializadas (whitelist). Para JSON/XML, use parsers que não executem código (como JSON simples, evite eval). Considere alternativas seguras como Protocol Buffers ou MessagePack, e mantenha bibliotecas críticas atualizadas.

CVE-2024-2006HIGHPost Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.7 - Authenticated (Contributor+) PHP Object Injection in outpost_shortcode_metabox_markupEPSS 1.2%CVE-2021-21426CRITICALFixes a bug in Zend Framework's Stream HTTP WrapperEPSS 1.2%CVE-2023-3232MEDIUMZhong Bang CRMEB Image Upload app_auth deserializationEPSS 1.2%CVE-2021-32742HIGHUntrusted data fed into `Data.init(base32Encoded:)` can result in exposing server memory and/or crashEPSS 1.2%CVE-2026-23746CRITICALEntrust Instant Financial Issuance (IFI) SmartCardController Service .NET Remoting RCEEPSS 1.2%CVE-2024-6793CRITICALDeserialization of Untrusted Data in NI VeriStand DataLogging ServerEPSS 1.2%CVE-2024-43383HIGHApache Lucene.Net.Replicator: Remote Code Execution in Lucene.Net.ReplicatorEPSS 1.2%CVE-2023-51518CRITICALApache James server: Privilege escalation via JMX pre-authentication deserialisationEPSS 1.2%CVE-2024-28213CRITICALnGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbiEPSS 1.2%CVE-2026-6857HIGHCamel-infinispan: camel-infinispan: remote code execution via unsafe deserializationEPSS 1.2%CVE-2025-3439CRITICALEverest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress <= 3.1.1 - Unauthenticated PHP Object InjectionEPSS 1.2%CVE-2023-22850HIGHTiki before 24.1, when the Spreadsheets feature is enabled, allows lib/sheet/grid.php PHP Object Injection because of an unserialize call.EPSS 1.2%CVE-2023-3234MEDIUMZhong Bang CRMEB PublicController.php put_image deserializationEPSS 1.2%CVE-2026-67587HIGHApache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadgetEPSS 1.2%CVE-2024-3070CRITICALLast Viewed Posts by WPBeginner <= 1.0.0 - Unauthenticated PHP Object InjectionEPSS 1.2%CVE-2024-9511CRITICALFluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider <= 2.2.82 - Unauthenticated PHP Object InjectionEPSS 1.2%CVE-2025-53002HIGHLLaMA-Factory Remote Code Execution (RCE) VulnerabilityEPSS 1.2%CVE-2024-1950HIGHProduct Carousel Slider & Grid Ultimate for WooCommerce <= 1.9.7 - Authenticated(Contributor+) PHP Object InjectionEPSS 1.2%CVE-2024-6794CRITICALDeserialization of Untrusted Data in NI VeriStand Waveform Streaming ServerEPSS 1.2%CVE-2024-21217LOWVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: SerialiEPSS 1.1%