Fallos del tipo CWE-502

2673 resultados

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados recebidos (JSON, XML, binário) sem validar se o resultado é seguro. Um atacante pode injetar código malicioso ou estruturas que exploram o processo de desserialização para executar ações arbitrárias no servidor ou cliente.

Ejemplo

Um serviço Java desserializa um objeto enviado pelo usuário usando ObjectInputStream sem filtros. O atacante envia um payload serializado que, ao ser reconstituído, executa comandos do sistema. Cenário comum: aplicações legadas que confiam em dados de rede ou arquivos sem inspeção.

Cómo mitigar

Valide e filtre dados antes de desserializar — use listas de classes permitidas (whitelisting), implemente validação de schema, e prefira formatos simples (JSON com parse restritivo) em vez de binários com lógica automática. Para linguagens críticas como Java, use bibliotecas seguras ou desabilite gadgets perigosos.

CVE-2026-69659MEDIUMMemory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.KeysetEPSS 0.4%CVE-2025-61505MEDIUMe107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script. The script processes user-controlled input in thEPSS 0.4%CVE-2025-60830MEDIUMredragon-erp v1.0 was discovered to contain a Shiro deserialization vulnerability caused by the default Shiro key.EPSS 0.4%CVE-2026-22471HIGHWordPress Secudeal Payments for Ecommerce plugin <= 1.1 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2026-23544HIGHWordPress Valenti theme <= 5.6.3.5 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2026-25551HIGHSeagull Software BarTender Deserialization Privilege Escalation via .NET Remoting ServiceEPSS 0.4%CVE-2025-68531HIGHWordPress ModelTheme Addons for WPBakery and Elementor plugin < 1.5.6 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2026-22345HIGHWordPress Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery plugin <= 1.6.0 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2024-28964HIGHDell Common Event Enabler, version 8.9.10.0 and prior, contain an insecure deserialization vulnerability in CAVATools. A local unauthenticatEPSS 0.4%CVE-2025-69328HIGHWordPress Booking and Rental Manager plugin <= 2.5.9 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2026-22346HIGHWordPress Slider Responsive Slideshow – Image slider, Gallery slideshow plugin <= 1.5.4 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2026-31249HIGHCosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in EPSS 0.4%CVE-2025-15453MEDIUMmilvus HTTP Endpoint expr.go expr.Exec deserializationEPSS 0.4%CVE-2026-31250HIGHCosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in EPSS 0.4%CVE-2026-81867CRITICALDeserialization of Untrusted Data in Application Integration allows Remote Code ExecutionEPSS 0.4%CVE-2024-39334MEDIUMMENDELSON AS4 before 2024 B376 has a client-side vulnerability when a trading partner provides prepared XML data. When a victim opens the deEPSS 0.4%CVE-2026-5473LOWNASA cFS Pickle pickle.load deserializationEPSS 0.4%CVE-2025-60080HIGHWordPress PDF for Gravity Forms + Drag And Drop Template Builder plugin <= 6.5.0 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2025-15276HIGHFontForge SFD File Parsing Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 0.4%CVE-2022-27580—A deserialization vulnerability in a .NET framework class used and not properly checked by Safety Designer all versions up to and including EPSS 0.4%