Falhas do tipo CWE-502

2.666 resultados

Desserialização de dados não confiáveis

A aplicação converte dados recebidos de fontes externas (requisições, arquivos, rede) de volta para objetos em memória sem validar se o conteúdo é legítimo. Um atacante pode enviar dados malformados ou maliciosos que, ao serem desserializados, executam código arbitrário ou alteram o comportamento da aplicação.

Exemplo

Um servidor Java que desserializa objetos vindo de um cliente usando ObjectInputStream sem verificar a origem. Um atacante envia um objeto serializado contendo uma gadget chain que executa comandos do sistema operacional quando desserializado.

Como mitigar

Valide rigorosamente o tipo e estrutura dos dados antes de desserializar; use bibliotecas modernas que restringem quais classes podem ser desserializadas (com allowlists); considere alternativas como JSON com parsers estritamente tipados ao invés de serialização nativa de linguagem.

CVE-2025-61765MEDIUMpython-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server deploymentsEPSS 0.5%CVE-2025-69130HIGHWordPress Entrepreneur - Booking for Small Businesses WordPress Theme theme < 3.1.5 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2026-25925HIGHPowerDocu Affected by Remote Code Execution via Insecure DeserializationEPSS 0.5%CVE-2026-23798HIGHWordPress PowerPress Podcasting plugin <= 11.15.10 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2026-41855HIGHSpring Framework Unsafe Deserialization via Jackson JMS ConvertersEPSS 0.5%CVE-2025-32145HIGHWordPress WpEvently plugin <= 4.3.6 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2025-32662HIGHWordPress uListing plugin <= 2.2.0 - Deserialization of untrusted data vulnerabilityEPSS 0.5%CVE-2025-32647HIGHWordPress Question Answer plugin <= 1.2.73 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2025-39527HIGHWordPress Rating by BestWebSoft plugin <= 1.7 - PHP Object Injection VulnerabilityEPSS 0.5%CVE-2025-54012HIGHWordPress Welcart e-Commerce Plugin <= 2.11.16 - PHP Object Injection VulnerabilityEPSS 0.5%CVE-2025-30889HIGHWordPress Testimonial Slider plugin <= 2.0.13 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2025-60889CRITICALInsecure deserialization of untrusted input in StellarGroup HPX 1.11.0 under certain conditions may allow attackers to execute arbitrary codEPSS 0.5%CVE-2026-37552HIGHUnsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke TCP server (Server.php:87) receives data from a TCEPSS 0.5%CVE-2026-55223MEDIUMc3p0 exposes a deserialization "sink" via JDBC DataSource bean propertiesEPSS 0.5%CVE-2025-71378HIGHpicklescan - Remote Code Execution via Undetected cProfile.runctx in Pickle FilesEPSS 0.5%CVE-2025-49073CRITICALWordPress Sweet Dessert < 1.1.13 - PHP Object Injection VulnerabilityEPSS 0.5%CVE-2025-30165HIGHRemote Code Execution Vulnerability in vLLM Multi-Node Cluster ConfigurationEPSS 0.5%CVE-2025-48289CRITICALWordPress Kids Planet theme <= 2.2.14 - PHP Object Injection VulnerabilityEPSS 0.5%CVE-2025-39410CRITICALWordPress Smart Sections Theme Builder - WPBakery Page Builder Addon plugin <= 1.7.8 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2023-36381MEDIUMWordPress Zippy Plugin <= 1.6.5 is vulnerable to PHP Object InjectionEPSS 0.5%