Falhas do tipo CWE-502

3.019 resultados

Desserialização de dados não confiáveis

A aplicação converte dados recebidos de fontes externas (requisições, arquivos, rede) de volta para objetos em memória sem validar se o conteúdo é legítimo. Um atacante pode enviar dados malformados ou maliciosos que, ao serem desserializados, executam código arbitrário ou alteram o comportamento da aplicação.

Exemplo

Um servidor Java que desserializa objetos vindo de um cliente usando ObjectInputStream sem verificar a origem. Um atacante envia um objeto serializado contendo uma gadget chain que executa comandos do sistema operacional quando desserializado.

Como mitigar

Valide rigorosamente o tipo e estrutura dos dados antes de desserializar; use bibliotecas modernas que restringem quais classes podem ser desserializadas (com allowlists); considere alternativas como JSON com parsers estritamente tipados ao invés de serialização nativa de linguagem.

CVE-2025-69690CRITICALNetgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the EPSS 0.8%CVE-2024-10079HIGHWP Easy Post Types <= 1.4.4 - Authenticated (Subscriber+) PHP Object InjectionEPSS 0.8%CVE-2026-13293HIGHIBM MQ Java messaging is vulnerable to remote code executionEPSS 0.8%CVE-2025-30773HIGHWordPress TranslatePress plugin <= 2.9.6 - PHP Object Injection VulnerabilityEPSS 0.8%CVE-2026-64608CRITICALApache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip pathsEPSS 0.8%CVE-2026-61484CRITICALApache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoSEPSS 0.8%CVE-2024-8922HIGHProduct Enquiry for WooCommerce <= 2.2.33.33 - Authenticated (Author+) PHP Object Injection in enquiry_detail.phpEPSS 0.8%CVE-2025-67617CRITICALWordPress Consult Aid theme <= 1.4.3 - PHP Object Injection vulnerabilityEPSS 0.8%CVE-2026-18490HIGHIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.8%CVE-2024-37060HIGHDeserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously craftEPSS 0.8%CVE-2022-42919HIGHPython 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python muEPSS 0.8%CVE-2025-11622HIGHInsecure deserialization in Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to escalate their privilegEPSS 0.8%CVE-2026-71559HIGHApache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadataEPSS 0.8%CVE-2024-23636CRITICALSOFARPC Remote Command Execution(RCE) VulnerbilityEPSS 0.8%CVE-2026-24747HIGHPyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint FilesEPSS 0.8%CVE-2024-10932HIGHBackup Migration <= 1.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialize_replace'EPSS 0.8%CVE-2025-34060CRITICALMonero Forum Remote Code Execution via Arbitrary File Read and Cookie ForgeryEPSS 0.8%CVE-2023-32242CRITICALWordPress Woodmart Core Plugin <= 1.0.36 is vulnerable to PHP Object InjectionEPSS 0.8%CVE-2025-59285HIGHAzure Monitor Agent Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2026-87112HIGHQA Assistants <= 5.3.0 - Unauthenticated PHP Object Injection to Remote Code Execution via 'raw_name' and 'dlevent_ver' ParametersEPSS 0.8%