Weaknesses of type CWE-502

2,665 results

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados serializados (JSON, XML, binário) recebidos de fontes externas sem validar adequadamente se o conteúdo é legítimo. Um atacante pode injetar código malicioso ou objetos especialmente crafted que são executados durante a desserialização, comprometendo toda a aplicação.

Example

Um servidor Java desserializa objetos recebidos em requisições HTTP usando ObjectInputStream, sem verificar a classe ou origem dos dados. Um atacante envia um objeto serializado contendo uma cadeia de gadgets (RCE via biblioteca como Apache Commons Collections) que é executada assim que o objeto é reconstruído em memória.

How to mitigate

Valide e liste explicitamente as classes que podem ser desserializadas (whitelist). Para JSON/XML, use parsers que não executem código (como JSON simples, evite eval). Considere alternativas seguras como Protocol Buffers ou MessagePack, e mantenha bibliotecas críticas atualizadas.

CVE-2025-10363CRITICALUnauthenticated RCE via .NET Deserialization in Topal Finance SoftwareEPSS 0.6%CVE-2026-0726HIGHNexter Extension – Site Enhancements Toolkit <= 4.4.6 - Unauthenticated PHP Object Injection via 'nxt_unserialize_replace'EPSS 0.6%CVE-2024-52443CRITICALWordPress Geolocator plugin <= 1.1 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2024-52440CRITICALWordPress Xpresslane Fast Checkout plugin <= 1.0.0 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2026-58233HIGHRemote Code Execution vulnerability in SAP Change and Transport System Attach Tool (ctsattach)EPSS 0.6%CVE-2025-68047HIGHWordPress Eventin plugin <= 4.1.3 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2025-29310CRITICALAn issue in onos v2.7.0 allows attackers to trigger a packet deserialization problem when supplying a crafted LLDP packet. This vulnerabilitEPSS 0.6%CVE-2024-52439CRITICALWordPress Team Rosters plugin <= 4.8.2 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2026-31221HIGHPyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading mechanismEPSS 0.6%CVE-2024-49624CRITICALWordPress Advanced Advertising System plugin <= 1.3.1 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2024-47636CRITICALWordPress WP JobSearch plugin <= 2.5.9 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2025-71348HIGHpicklescan - Arbitrary Code Execution via torch.utils._config_module.load_config BypassEPSS 0.6%CVE-2022-3536HIGHRole Based Pricing for WooCommerce < 1.6.3 - Subscriber+ PHAR DeserializationEPSS 0.6%CVE-2026-12583HIGHNewsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom FieldEPSS 0.6%CVE-2025-30023CRITICALThe communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execuEPSS 0.6%CVE-2024-30230HIGHWordPress PDF Invoices and Packing Slips For WooCommerce plugin <= 1.3.7 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2021-27017MEDIUMDeserialization of untrusted dataEPSS 0.6%CVE-2026-15962HIGHFluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta FieldEPSS 0.5%CVE-2025-47629HIGHWordPress WP-CRM System plugin <= 3.4.5 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2026-60366CRITICALVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). SupporEPSS 0.5%