Weaknesses of type CWE-502

2,666 results

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados serializados (JSON, XML, binário) recebidos de fontes externas sem validar adequadamente se o conteúdo é legítimo. Um atacante pode injetar código malicioso ou objetos especialmente crafted que são executados durante a desserialização, comprometendo toda a aplicação.

Example

Um servidor Java desserializa objetos recebidos em requisições HTTP usando ObjectInputStream, sem verificar a classe ou origem dos dados. Um atacante envia um objeto serializado contendo uma cadeia de gadgets (RCE via biblioteca como Apache Commons Collections) que é executada assim que o objeto é reconstruído em memória.

How to mitigate

Valide e liste explicitamente as classes que podem ser desserializadas (whitelist). Para JSON/XML, use parsers que não executem código (como JSON simples, evite eval). Considere alternativas seguras como Protocol Buffers ou MessagePack, e mantenha bibliotecas críticas atualizadas.

CVE-2025-61765MEDIUMpython-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server deploymentsEPSS 0.5%CVE-2025-69130HIGHWordPress Entrepreneur - Booking for Small Businesses WordPress Theme theme < 3.1.5 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2026-25925HIGHPowerDocu Affected by Remote Code Execution via Insecure DeserializationEPSS 0.5%CVE-2026-23798HIGHWordPress PowerPress Podcasting plugin <= 11.15.10 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2026-41855HIGHSpring Framework Unsafe Deserialization via Jackson JMS ConvertersEPSS 0.5%CVE-2025-32145HIGHWordPress WpEvently plugin <= 4.3.6 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2025-32662HIGHWordPress uListing plugin <= 2.2.0 - Deserialization of untrusted data vulnerabilityEPSS 0.5%CVE-2025-32647HIGHWordPress Question Answer plugin <= 1.2.73 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2025-39527HIGHWordPress Rating by BestWebSoft plugin <= 1.7 - PHP Object Injection VulnerabilityEPSS 0.5%CVE-2025-54012HIGHWordPress Welcart e-Commerce Plugin <= 2.11.16 - PHP Object Injection VulnerabilityEPSS 0.5%CVE-2025-30889HIGHWordPress Testimonial Slider plugin <= 2.0.13 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2025-60889CRITICALInsecure deserialization of untrusted input in StellarGroup HPX 1.11.0 under certain conditions may allow attackers to execute arbitrary codEPSS 0.5%CVE-2026-37552HIGHUnsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke TCP server (Server.php:87) receives data from a TCEPSS 0.5%CVE-2026-55223MEDIUMc3p0 exposes a deserialization "sink" via JDBC DataSource bean propertiesEPSS 0.5%CVE-2025-71378HIGHpicklescan - Remote Code Execution via Undetected cProfile.runctx in Pickle FilesEPSS 0.5%CVE-2025-49073CRITICALWordPress Sweet Dessert < 1.1.13 - PHP Object Injection VulnerabilityEPSS 0.5%CVE-2025-30165HIGHRemote Code Execution Vulnerability in vLLM Multi-Node Cluster ConfigurationEPSS 0.5%CVE-2025-48289CRITICALWordPress Kids Planet theme <= 2.2.14 - PHP Object Injection VulnerabilityEPSS 0.5%CVE-2025-39410CRITICALWordPress Smart Sections Theme Builder - WPBakery Page Builder Addon plugin <= 1.7.8 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2023-36381MEDIUMWordPress Zippy Plugin <= 1.6.5 is vulnerable to PHP Object InjectionEPSS 0.5%