Falhas do tipo CWE-502

2.657 resultados

Desserialização de dados não confiáveis

A aplicação converte dados recebidos de fontes externas (requisições, arquivos, rede) de volta para objetos em memória sem validar se o conteúdo é legítimo. Um atacante pode enviar dados malformados ou maliciosos que, ao serem desserializados, executam código arbitrário ou alteram o comportamento da aplicação.

Exemplo

Um servidor Java que desserializa objetos vindo de um cliente usando ObjectInputStream sem verificar a origem. Um atacante envia um objeto serializado contendo uma gadget chain que executa comandos do sistema operacional quando desserializado.

Como mitigar

Valide rigorosamente o tipo e estrutura dos dados antes de desserializar; use bibliotecas modernas que restringem quais classes podem ser desserializadas (com allowlists); considere alternativas como JSON com parsers estritamente tipados ao invés de serialização nativa de linguagem.

CVE-2025-31084CRITICALWordPress Sunshine Photo Cart plugin <= 3.4.10 - PHP Object Injection VulnerabilityEPSS 0.7%CVE-2026-57822MEDIUMApache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of serviceEPSS 0.7%CVE-2026-41486HIGHRay: Remote Code Execution via Parquet Arrow Extension Type DeserializationEPSS 0.7%CVE-2026-8024CRITICALDeserialization vulnerability in ibaPDA and ibaDatCoordinatorEPSS 0.7%CVE-2025-7504HIGHFriends 3.5.1 - Authenticated (Subscriber+) PHP Object InjectionEPSS 0.7%CVE-2024-37054HIGHDeserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploadEPSS 0.7%CVE-2025-31612CRITICALWordPress CBX Poll plugin <= 2.0.4 - PHP Object Injection vulnerabilityEPSS 0.7%CVE-2026-22016HIGHVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). EPSS 0.7%CVE-2025-62373CRITICALPipecat vulnerable to Remote Code Execution by Pickle Deserialization via LivekitFrameSerializerEPSS 0.7%CVE-2026-42473CRITICALUnsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache handlers use unserialize() on data from the EPSS 0.7%CVE-2026-42472CRITICALUnsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache handlers use unserialize() on data from RediEPSS 0.7%CVE-2026-58163HIGHApache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the serverEPSS 0.7%CVE-2025-67617CRITICALWordPress Consult Aid theme <= 1.4.3 - PHP Object Injection vulnerabilityEPSS 0.7%CVE-2022-23535HIGHLiteDB contains Deserialization of Untrusted DataEPSS 0.7%CVE-2024-30228CRITICALWordPress Hercules Core plugin <= 6.4 - Auth. PHP Object Injection vulnerabilityEPSS 0.7%CVE-2025-31932HIGHDeserialization of untrusted data issue exists in BizRobo! all versions. If this vulnerability is exploited, an arbitrary code is executed oEPSS 0.7%CVE-2025-24357HIGHvLLM allows a malicious model RCE by torch.load in hf_model_weights_iteratorEPSS 0.7%CVE-2024-5871CRITICALWooCommerce - Social Login <= 2.6.2 - Unauthenticated PHP Object InjectionEPSS 0.7%CVE-2021-47952CRITICALpython jsonpickle 2.0.0 Remote Code Execution via py/reprEPSS 0.7%CVE-2024-4157HIGHContact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValuesEPSS 0.7%