Fallos del tipo CWE-502

2668 resultados

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados recebidos (JSON, XML, binário) sem validar se o resultado é seguro. Um atacante pode injetar código malicioso ou estruturas que exploram o processo de desserialização para executar ações arbitrárias no servidor ou cliente.

Ejemplo

Um serviço Java desserializa um objeto enviado pelo usuário usando ObjectInputStream sem filtros. O atacante envia um payload serializado que, ao ser reconstituído, executa comandos do sistema. Cenário comum: aplicações legadas que confiam em dados de rede ou arquivos sem inspeção.

Cómo mitigar

Valide e filtre dados antes de desserializar — use listas de classes permitidas (whitelisting), implemente validação de schema, e prefira formatos simples (JSON com parse restritivo) em vez de binários com lógica automática. Para linguagens críticas como Java, use bibliotecas seguras ou desabilite gadgets perigosos.

CVE-2026-20211CRITICALCisco Identity Services Engine Remote Code Execution VulnerabilityEPSS 0.6%CVE-2024-37099CRITICALWordPress GiveWP plugin <= 3.14.1 - Unauthenticated PHP Object Injection vulnerabilityEPSS 0.6%CVE-2025-23914CRITICALWordPress Muzaara Google Ads Report Plugin <= 3.1 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2025-10363CRITICALUnauthenticated RCE via .NET Deserialization in Topal Finance SoftwareEPSS 0.6%CVE-2026-0726HIGHNexter Extension – Site Enhancements Toolkit <= 4.4.6 - Unauthenticated PHP Object Injection via 'nxt_unserialize_replace'EPSS 0.6%CVE-2026-58233HIGHRemote Code Execution vulnerability in SAP Change and Transport System Attach Tool (ctsattach)EPSS 0.6%CVE-2024-52439CRITICALWordPress Team Rosters plugin <= 4.8.2 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2024-52443CRITICALWordPress Geolocator plugin <= 1.1 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2024-52440CRITICALWordPress Xpresslane Fast Checkout plugin <= 1.0.0 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2025-68047HIGHWordPress Eventin plugin <= 4.1.3 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2025-29310CRITICALAn issue in onos v2.7.0 allows attackers to trigger a packet deserialization problem when supplying a crafted LLDP packet. This vulnerabilitEPSS 0.6%CVE-2026-31221HIGHPyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading mechanismEPSS 0.6%CVE-2025-71348HIGHpicklescan - Arbitrary Code Execution via torch.utils._config_module.load_config BypassEPSS 0.6%CVE-2024-49624CRITICALWordPress Advanced Advertising System plugin <= 1.3.1 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2024-47636CRITICALWordPress WP JobSearch plugin <= 2.5.9 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2026-12583HIGHNewsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom FieldEPSS 0.6%CVE-2022-3536HIGHRole Based Pricing for WooCommerce < 1.6.3 - Subscriber+ PHAR DeserializationEPSS 0.6%CVE-2025-30023CRITICALThe communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execuEPSS 0.6%CVE-2024-30230HIGHWordPress PDF Invoices and Packing Slips For WooCommerce plugin <= 1.3.7 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2021-27017MEDIUMDeserialization of untrusted dataEPSS 0.6%