Weaknesses of type CWE-502

2,665 results

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados serializados (JSON, XML, binário) recebidos de fontes externas sem validar adequadamente se o conteúdo é legítimo. Um atacante pode injetar código malicioso ou objetos especialmente crafted que são executados durante a desserialização, comprometendo toda a aplicação.

Example

Um servidor Java desserializa objetos recebidos em requisições HTTP usando ObjectInputStream, sem verificar a classe ou origem dos dados. Um atacante envia um objeto serializado contendo uma cadeia de gadgets (RCE via biblioteca como Apache Commons Collections) que é executada assim que o objeto é reconstruído em memória.

How to mitigate

Valide e liste explicitamente as classes que podem ser desserializadas (whitelist). Para JSON/XML, use parsers que não executem código (como JSON simples, evite eval). Considere alternativas seguras como Protocol Buffers ou MessagePack, e mantenha bibliotecas críticas atualizadas.

CVE-2024-11465HIGHCustom Product Tabs for WooCommerce <= 1.8.5 - Authenticated (Shop Manager+) PHP Object InjectionEPSS 1.0%CVE-2024-3020HIGHCarousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Admin+) PHP Object InjectionEPSS 1.0%CVE-2026-71981HIGHCypht < 2.12.2 PHP Object Injection RCE via back_query ParameterEPSS 1.0%CVE-2026-14512CRITICALIBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive informationEPSS 1.0%CVE-2023-46227HIGHApache inlong has an Arbitrary File Read VulnerabilityEPSS 1.0%CVE-2022-3342HIGHJetpack CRM <= 5.3.1 - Cross-Site Request Forgery and PHAR DeserializationEPSS 1.0%CVE-2024-31903HIGHIBM Sterling B2B Integrator Standard Edition code executionEPSS 1.0%CVE-2024-1773HIGHPDF Invoices and Packing Slips For WooCommerce <= 1.3.7 - Authenticated (Subscriber+) PHP Object InjectionEPSS 1.0%CVE-2026-26978HIGHFree PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.phpEPSS 1.0%CVE-2026-83497HIGHUnrestricted Java Deserialization in OpenSearch SQL Plugin Cursor PaginationEPSS 1.0%CVE-2024-13980CRITICALH3C Intelligent Management Center (iMC) /byod/index.xhtml RCEEPSS 1.0%CVE-2026-43642CRITICALSoftaculous Virtualizor PHP Object Injection via Billing Module HandlerEPSS 1.0%CVE-2026-27794MEDIUMLangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code ExecutionEPSS 1.0%CVE-2025-47277CRITICALvLLM Allows Remote Code Execution via PyNcclPipe Communication ServiceEPSS 1.0%CVE-2023-48952HIGHAn issue in the box_deserialize_reusing function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS)EPSS 1.0%CVE-2026-58281HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 1.0%CVE-2025-34414CRITICALEntrust Instant Financial Issuance (IFI) Legacy Remoting Service .NET Remoting RCEEPSS 1.0%CVE-2026-20307CRITICALCisco Identity Services Engine Remote Code Execution VulnerabilityEPSS 1.0%CVE-2023-3259CRITICALThe Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass. By manipulating the IP addEPSS 1.0%CVE-2023-34347CRITICAL​Delta Electronics InfraSuite Device Master Deserialization of Untrusted DataEPSS 1.0%