Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 1,303
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 798678 Cwe 894152 Cwe 8624031 Cwe 2844027 Cwe 4163896 Cwe 1193182 Cwe 2003138 Cwe 1253115 Cwe 202856 Cwe 222769 Cwe 7872517 Cwe 782021 Cwe 941870 Cwe 8631865 Cwe 1221799

🛡 Vulnerabilities tagged with this 1,305

Image ID Title
CVE-2026-104736 Unsafe Deserialization in LearnPress (WordPress plugin) (CVE-2026-104736)
CVE-2026-104734 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is...
CVE-2026-111628 Unsafe Deserialization in 10up Distributor (CVE-2026-111628)
CVE-2026-64610 Unsafe Deserialization in Apache (CVE-2026-64610)
CVE-2026-97296 Unsafe Deserialization in Gravity Forms (CVE-2026-97296)
CVE-2026-104730 Unsafe Deserialization in WordPress (CVE-2026-104730)
CVE-2026-104932 Unsafe Deserialization in Search Regex (WordPress plugin) (CVE-2026-104932)
CVE-2026-75941 A potential vulnerability was reported in the Lenovo Legion Zone application, distributed...
CVE-2026-111160 Unsafe Deserialization in LightLLM (CVE-2026-111160)
CVE-2026-110874 Unsafe Deserialization in Dolibarr (CVE-2026-110874)
CVE-2026-47218 runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1…
CVE-2026-111094 Unsafe Deserialization in Jetbrains Teamcity (CVE-2026-111094)
CVE-2026-109686 Unsafe Deserialization in Link Whisper Free (CVE-2026-109686)
CVE-2026-110812 Unsafe Deserialization in Amazon Neptune (CVE-2026-110812)
CVE-2026-47168 Unsafe Deserialization in EspoCRM (CVE-2026-47168)
CVE-2026-102469 Unsafe Deserialization in Eclipse Vert.x (CVE-2026-102469)
CVE-2026-110761 Unsafe Deserialization in ILIAS (CVE-2026-110761)
CVE-2026-55573 Unsafe Deserialization in e107 (CVE-2026-55573)
CVE-2026-108291 Unsafe Deserialization in Affiliates (CVE-2026-108291)
CVE-2026-97278 Unsafe Deserialization in Polylang (CVE-2026-97278)
CVE-2026-106599 Unsafe Deserialization in SureCart (CVE-2026-106599)
CVE-2026-73793 HPE NonStop Middleware software has secret key handling and data deserialization vulnerability.
CVE-2026-104764 Unsafe Deserialization in WordPress (CVE-2026-104764)
CVE-2026-93905 Unsafe Deserialization in IBM WebSphere Application Server - Liberty (CVE-2026-93905)
CVE-2026-65674 Unsafe Deserialization in Microsoft SQL Server (CVE-2026-65674)
CVE-2026-49950 Unsafe Deserialization in Xorbits Xoscar (CVE-2026-49950)
CVE-2026-105442 Unsafe Deserialization in IBM WebSphere Application Server (CVE-2026-105442)
CVE-2026-70035 Unsafe Deserialization in Microsoft.WindowsDesktop.App.Runtime.win-arm64 (CVE-2026-70035)
CVE-2026-87697 Unsafe Deserialization in Microsoft.WindowsDesktop.App.Runtime.win-arm64 (CVE-2026-87697)
CVE-2026-83520 Unsafe Deserialization in Microsoft.WindowsDesktop.App.Runtime.win-arm64 (CVE-2026-83520)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details