Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 1,305
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801

🛡 Vulnerabilities tagged with this 1,309

Image ID Title
CVE-2026-10036 Unsafe Deserialization in SpeechBrain (CVE-2026-10036)
CVE-2026-78286 Unsafe Deserialization in Geo Controller (CVE-2026-78286)
CVE-2026-78292 Unsafe Deserialization in Hash Form (CVE-2026-78292)
CVE-2026-78276 Unsafe Deserialization in Fluent Boards Pro (CVE-2026-78276)
CVE-2026-78257 Unsafe Deserialization in Booking (CVE-2026-78257)
CVE-2026-59275 Unsafe Deserialization in Vmware Spring Advanced Message Queuing Protocol (CVE-2026-59275)
CVE-2026-47878 Unsafe Deserialization in Broadcom Spring Batch (CVE-2026-47878)
CVE-2026-47864 Unsafe Deserialization in Vmware Spring Integration (CVE-2026-47864)
CVE-2026-47875 Unsafe Deserialization in Broadcom Spring Batch (CVE-2026-47875)
CVE-2026-47856 Unsafe Deserialization in Spring Integration (CVE-2026-47856)
CVE-2026-51106 Vulnerability in TokTok qTox (CVE-2026-51106)
CVE-2026-80428 ILIAS deserialises stored session data for an unauthenticated caller. The Shibboleth back-channel...
CVE-2021-23758 KEV [KEV] Unsafe Deserialization in Ajax.net professional AjaxNetProfessional (CVE-2021-23758)
CVE-2026-51368 Unsafe Deserialization in Beijing Tongtech Co (CVE-2026-51368)
CVE-2026-79657 Unsafe Deserialization in nltk (CVE-2026-79657)
CVE-2026-78572 Unsafe Deserialization in Kalles Addons (WordPress plugin) (CVE-2026-78572)
CVE-2026-77138 The extension fails to safely process untrusted client input of an attacker-controlled cookie...
CVE-2026-56095 The extension's indexer passed every field value returned by content object rendering through PHP...
CVE-2026-78683 Unsafe Deserialization in nltk (CVE-2026-78683)
CVE-2026-78265 Unsafe Deserialization in Events Calendar (CVE-2026-78265)
CVE-2026-78262 Unsafe Deserialization in WP Project Manager (CVE-2026-78262)
CVE-2026-32563 Unsafe Deserialization in WordPress (CVE-2026-32563)
CVE-2026-40877 Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in…
CVE-2026-76843 The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose...
CVE-2026-66650 Unsafe Deserialization in FreightCo (CVE-2026-66650)
CVE-2026-78147 Vulnerability in ggml-org llama.cpp bec4772f6 (CVE-2026-78147)
CVE-2026-0551 Unsafe Deserialization in PPWP – Password Protect Pages (WordPress plugin) (CVE-2026-0551)
CVE-2026-4703 Unsafe Deserialization in WordPress (CVE-2026-4703)
CVE-2026-71513 Unsafe Deserialization in nltk (CVE-2026-71513)
CVE-2026-77645 A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC...

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details