Falhas do tipo CWE-502

3.021 resultados

Desserialização de dados não confiáveis

A aplicação converte dados recebidos de fontes externas (requisições, arquivos, rede) de volta para objetos em memória sem validar se o conteúdo é legítimo. Um atacante pode enviar dados malformados ou maliciosos que, ao serem desserializados, executam código arbitrário ou alteram o comportamento da aplicação.

Exemplo

Um servidor Java que desserializa objetos vindo de um cliente usando ObjectInputStream sem verificar a origem. Um atacante envia um objeto serializado contendo uma gadget chain que executa comandos do sistema operacional quando desserializado.

Como mitigar

Valide rigorosamente o tipo e estrutura dos dados antes de desserializar; use bibliotecas modernas que restringem quais classes podem ser desserializadas (com allowlists); considere alternativas como JSON com parsers estritamente tipados ao invés de serialização nativa de linguagem.

CVE-2026-87112HIGHQA Assistants <= 5.3.0 - Unauthenticated PHP Object Injection to Remote Code Execution via 'raw_name' and 'dlevent_ver' ParametersEPSS 0.8%CVE-2024-11949HIGHGFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 0.8%CVE-2025-68665HIGHLangChain serialization injection vulnerability enables secret extractionEPSS 0.8%CVE-2024-11947HIGHGFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 0.8%CVE-2026-33725HIGHMetabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization ImportEPSS 0.8%CVE-2025-25940CRITICALVisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java.EPSS 0.8%CVE-2024-28211CRITICALnGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing arbitrary code via RMIEPSS 0.8%CVE-2024-20150HIGHIn Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service with no additional execution prEPSS 0.8%CVE-2022-37936CRITICALUnauthenticated Java deserialization vulnerability in Serviceguard Manager EPSS 0.8%CVE-2026-29001HIGHTastyIgniter 4.4.5 PHP Object Injection via Settings DeserializationEPSS 0.8%CVE-2025-2105HIGHJupiter X Core <= 4.8.11 - Unauthenticated PHP Object Injection via PHAREPSS 0.8%CVE-2024-56180CRITICALApache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code executionEPSS 0.8%CVE-2023-1399HIGH N6854A Geolocation Server versions 2.4.2 are vulnerable to untrusted data deserialization, which may allow a malicious actor to escalate prEPSS 0.8%CVE-2025-49837HIGHGHSL-2025-049: GPT-SoVITS Deserialization of Untrusted Data vulnerabilityEPSS 0.8%CVE-2025-62703HIGHFugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServerEPSS 0.8%CVE-2026-48853CRITICALRemote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpcEPSS 0.8%CVE-2025-49839HIGHGHSL-2025-051: GPT-SoVITS Deserialization of Untrusted Data vulnerabilityEPSS 0.8%CVE-2025-49838HIGHGHSL-2025-050: GPT-SoVITS Deserialization of Untrusted Data vulnerabilityEPSS 0.8%CVE-2026-64606CRITICALApache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interfaceEPSS 0.8%CVE-2026-73699HIGHFileRun < 2026.3.0 PHP Object Injection via Perms::getPerms()EPSS 0.8%