Weaknesses of type CWE-502

2,665 results

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados serializados (JSON, XML, binário) recebidos de fontes externas sem validar adequadamente se o conteúdo é legítimo. Um atacante pode injetar código malicioso ou objetos especialmente crafted que são executados durante a desserialização, comprometendo toda a aplicação.

Example

Um servidor Java desserializa objetos recebidos em requisições HTTP usando ObjectInputStream, sem verificar a classe ou origem dos dados. Um atacante envia um objeto serializado contendo uma cadeia de gadgets (RCE via biblioteca como Apache Commons Collections) que é executada assim que o objeto é reconstruído em memória.

How to mitigate

Valide e liste explicitamente as classes que podem ser desserializadas (whitelist). Para JSON/XML, use parsers que não executem código (como JSON simples, evite eval). Considere alternativas seguras como Protocol Buffers ou MessagePack, e mantenha bibliotecas críticas atualizadas.

CVE-2024-49626CRITICALWordPress Shipyaari Shipping Management plugin <= 1.2 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2024-52414CRITICALWordPress WDES Responsive Mobile Menu plugin <= 5.3.18 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2024-52409CRITICALWordPress AJAX Random Posts plugin <= 0.3.3 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2024-52410CRITICALWordPress Referrer Detector plugin <= 4.2.1.0 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2024-52411CRITICALWordPress Advanced Personalization plugin <= 1.1.2 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2024-52412CRITICALWordPress Xin theme <= 1.0.8.1 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2024-48030CRITICALWordPress Telecash Ricaricaweb plugin <= 2.2 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2024-48026CRITICALWordPress Disc Golf Manager plugin <= 1.0.0 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2025-71375HIGHpicklescan - Undetected Remote Code Execution via _operator.methodcallerEPSS 0.5%CVE-2024-49318CRITICALWordPress My Reading Library plugin <= 1.0 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2024-49218CRITICALWordPress Recently plugin <= 1.1 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2024-52432CRITICALWordPress NIX Anti-Spam Light plugin <= 0.0.4 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2024-49227HIGHWordPress Free Stock Photos Foter plugin <= 1.5.4 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2025-71339HIGHPicklescan - Arbitrary Code Execution via numpy.f2py.crackfortran._eval_length GadgetEPSS 0.5%CVE-2024-48028CRITICALWordPress IP Loc8 plugin <= 1.1 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2024-43931CRITICALWordPress JobSearch WP Job Board WordPress Plugin plugin <= 2.5.3 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2024-33568HIGHWordPress Element Pack Pro plugin < 7.19.3 - Arbitrary File Read and Phar Deserialization vulnerabilityEPSS 0.5%CVE-2025-51427HIGHAn issue was discovered in ModelScope 1.25.0 allowing attackers to execute arbitrary code via crafted module listed in the configuration filEPSS 0.5%CVE-2025-0734MEDIUMy_project RuoYi Whitelist getBeanName deserializationEPSS 0.5%CVE-2026-22187MEDIUMBio-Formats <= 8.3.0 Memoizer Unsafe Deserialization via .bfmemo Cache FilesEPSS 0.5%