Fallos del tipo CWE-502

2669 resultados

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados recebidos (JSON, XML, binário) sem validar se o resultado é seguro. Um atacante pode injetar código malicioso ou estruturas que exploram o processo de desserialização para executar ações arbitrárias no servidor ou cliente.

Ejemplo

Um serviço Java desserializa um objeto enviado pelo usuário usando ObjectInputStream sem filtros. O atacante envia um payload serializado que, ao ser reconstituído, executa comandos do sistema. Cenário comum: aplicações legadas que confiam em dados de rede ou arquivos sem inspeção.

Cómo mitigar

Valide e filtre dados antes de desserializar — use listas de classes permitidas (whitelisting), implemente validação de schema, e prefira formatos simples (JSON com parse restritivo) em vez de binários com lógica automática. Para linguagens críticas como Java, use bibliotecas seguras ou desabilite gadgets perigosos.

CVE-2025-36072HIGHIBM webMethods Integration DeserializationEPSS 0.5%CVE-2025-60174CRITICALWordPress WP Gravity Forms Constant Contact plugin plugin <= 1.1.2 - Deserialization of untrusted data vulnerabilityEPSS 0.5%CVE-2025-60178CRITICALWordPress WP Gravity Forms HubSpot plugin <= 1.2.6 - Deserialization of untrusted data vulnerabilityEPSS 0.5%CVE-2025-58998CRITICALWordPress s2Member Plugin <= 250701 - PHP Object Injection VulnerabilityEPSS 0.5%CVE-2025-60091CRITICALWordPress WP Gravity Forms Zoho CRM and Bigin plugin <= 1.2.9 - Deserialization of untrusted data vulnerabilityEPSS 0.5%CVE-2025-58636CRITICALWordPress WP Gravity Forms Keap/Infusionsoft Plugin <= 1.2.3 - Deserialization of untrusted data VulnerabilityEPSS 0.5%CVE-2026-68756MEDIUMPotential insecure deserialization in JFrog ArtifactoryEPSS 0.5%CVE-2026-12256HIGHWordPress Avada theme <= 3.15.3 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2026-84650HIGHIn Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to EPSS 0.5%CVE-2025-15438MEDIUMPluXml Media Management medias.php __destruct deserializationEPSS 0.5%CVE-2025-58662HIGHWordPress Awesome Support plugin <= 6.3.5 - Deserialization of untrusted data vulnerabilityEPSS 0.5%CVE-2025-47536HIGHWordPress Content Egg plugin <= 7.0.0 - PHP Object Injection VulnerabilityEPSS 0.5%CVE-2026-1426HIGHAdvanced AJAX Product Filters <= 3.1.9.6 - Authenticated (Author+) PHP Object Injection via Live Composer CompatibilityEPSS 0.5%CVE-2025-58839HIGHWordPress eDS Responsive Menu Plugin <= 1.2 - PHP Object Injection VulnerabilityEPSS 0.5%CVE-2025-53990HIGHWordPress JetFormBuilder plugin <= 3.5.1.2 - PHP Object Injection VulnerabilityEPSS 0.5%CVE-2025-58815HIGHWordPress Aitasi Coming Soon Plugin <= 2.0.2 - Deserialization of untrusted data VulnerabilityEPSS 0.5%CVE-2026-60373HIGHVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). SupporEPSS 0.5%CVE-2026-60369CRITICALVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). SupporEPSS 0.5%CVE-2026-60439HIGHVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). SupporEPSS 0.5%CVE-2026-61246HIGHVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). SupporEPSS 0.5%