Falhas do tipo CWE-502

2.665 resultados

Desserialização de dados não confiáveis

A aplicação converte dados recebidos de fontes externas (requisições, arquivos, rede) de volta para objetos em memória sem validar se o conteúdo é legítimo. Um atacante pode enviar dados malformados ou maliciosos que, ao serem desserializados, executam código arbitrário ou alteram o comportamento da aplicação.

Exemplo

Um servidor Java que desserializa objetos vindo de um cliente usando ObjectInputStream sem verificar a origem. Um atacante envia um objeto serializado contendo uma gadget chain que executa comandos do sistema operacional quando desserializado.

Como mitigar

Valide rigorosamente o tipo e estrutura dos dados antes de desserializar; use bibliotecas modernas que restringem quais classes podem ser desserializadas (com allowlists); considere alternativas como JSON com parsers estritamente tipados ao invés de serialização nativa de linguagem.

CVE-2025-10363CRITICALUnauthenticated RCE via .NET Deserialization in Topal Finance SoftwareEPSS 0.6%CVE-2026-0726HIGHNexter Extension – Site Enhancements Toolkit <= 4.4.6 - Unauthenticated PHP Object Injection via 'nxt_unserialize_replace'EPSS 0.6%CVE-2024-52443CRITICALWordPress Geolocator plugin <= 1.1 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2024-52440CRITICALWordPress Xpresslane Fast Checkout plugin <= 1.0.0 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2026-58233HIGHRemote Code Execution vulnerability in SAP Change and Transport System Attach Tool (ctsattach)EPSS 0.6%CVE-2025-68047HIGHWordPress Eventin plugin <= 4.1.3 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2025-29310CRITICALAn issue in onos v2.7.0 allows attackers to trigger a packet deserialization problem when supplying a crafted LLDP packet. This vulnerabilitEPSS 0.6%CVE-2024-52439CRITICALWordPress Team Rosters plugin <= 4.8.2 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2026-31221HIGHPyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading mechanismEPSS 0.6%CVE-2024-49624CRITICALWordPress Advanced Advertising System plugin <= 1.3.1 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2024-47636CRITICALWordPress WP JobSearch plugin <= 2.5.9 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2025-71348HIGHpicklescan - Arbitrary Code Execution via torch.utils._config_module.load_config BypassEPSS 0.6%CVE-2022-3536HIGHRole Based Pricing for WooCommerce < 1.6.3 - Subscriber+ PHAR DeserializationEPSS 0.6%CVE-2026-12583HIGHNewsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom FieldEPSS 0.6%CVE-2025-30023CRITICALThe communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execuEPSS 0.6%CVE-2024-30230HIGHWordPress PDF Invoices and Packing Slips For WooCommerce plugin <= 1.3.7 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2021-27017MEDIUMDeserialization of untrusted dataEPSS 0.6%CVE-2026-15962HIGHFluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta FieldEPSS 0.5%CVE-2025-47629HIGHWordPress WP-CRM System plugin <= 3.4.5 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2026-60366CRITICALVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). SupporEPSS 0.5%