Weaknesses of type CWE-502

2,668 results

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados serializados (JSON, XML, binário) recebidos de fontes externas sem validar adequadamente se o conteúdo é legítimo. Um atacante pode injetar código malicioso ou objetos especialmente crafted que são executados durante a desserialização, comprometendo toda a aplicação.

Example

Um servidor Java desserializa objetos recebidos em requisições HTTP usando ObjectInputStream, sem verificar a classe ou origem dos dados. Um atacante envia um objeto serializado contendo uma cadeia de gadgets (RCE via biblioteca como Apache Commons Collections) que é executada assim que o objeto é reconstruído em memória.

How to mitigate

Valide e liste explicitamente as classes que podem ser desserializadas (whitelist). Para JSON/XML, use parsers que não executem código (como JSON simples, evite eval). Considere alternativas seguras como Protocol Buffers ou MessagePack, e mantenha bibliotecas críticas atualizadas.

CVE-2026-49109CRITICALWordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.4.3 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2026-84834CRITICALWordPress JobSearch plugin <= 3.2.0 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2026-57677CRITICALWordPress Novalnet Payment Gateway for WooCommerce plugin <= 12.10.3 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2026-40725CRITICALWordPress WooCommerce Product Filters plugin < 2.0.6 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2026-65574CRITICALWordPress Abogado theme <= 1.18 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2026-39529CRITICALWordPress Elementra theme <= 1.0.9 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2026-65579CRITICALWordPress Agricola theme <= 1.21.0 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2026-7861CRITICALCode Injection in Next4Biz's CSM (Customer Service Management)EPSS 0.6%CVE-2026-73993CRITICALWordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2026-32563CRITICALWordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2026-57770CRITICALWordPress Grand Photography theme <= 5.7.8 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2026-28074CRITICALWordPress Pizza House theme <= 1.4.0 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2026-52706CRITICALWordPress JetEngine plugin <= 3.8.10 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2026-28139CRITICALWordPress Ajax Search Lite plugin <= 4.14.4 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2026-27084CRITICALWordPress Buisson theme <= 1.1.11 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2026-25449CRITICALWordPress Traveler theme < 3.2.8.1 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2023-49826HIGHWordPress Soledad Theme <= 8.4.1 is vulnerable to PHP Object InjectionEPSS 0.6%CVE-2024-11662MEDIUMwelliamcao OpsManage API Endpoint deploy_api.py deploy_host_vars deserializationEPSS 0.6%CVE-2026-77645CRITICALCritical Remote Code Execution (RCE) vulnerability reported in WindchillEPSS 0.6%CVE-2024-13786CRITICALEducation Center | LMS & Online Courses WordPress Theme <= 3.6.10 - PHP Object InjectionEPSS 0.6%