Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 1,305
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801

🛡 Vulnerabilities tagged with this 1,306

Image ID Title
CVE-2026-69098 Unsafe Deserialization in kotaemon (CVE-2026-69098)
CVE-2026-18642 Unsafe Deserialization in eta-otp-lock (CVE-2026-18642)
CVE-2026-16297 Unsafe Deserialization in Clearfy Cache (WordPress plugin) (CVE-2026-16297)
CVE-2025-15672 Unsafe Deserialization in ChamaWP (WordPress plugin) (CVE-2025-15672)
CVE-2026-3245 Unsafe Deserialization in PRISMAproduction Version 6.5 or earlier (CVE-2026-3245)
CVE-2026-16062 Unsafe Deserialization in Event Booking Manager for WooCommerce (WordPress plugin) (CVE-2026-16062)
CVE-2026-68771 Unsafe Deserialization in ComfyUI (CVE-2026-68771)
CVE-2026-12720 Unsafe Deserialization in Kirki (WordPress plugin) (CVE-2026-12720)
CVE-2026-15976 Unsafe Deserialization in SGLang (CVE-2026-15976)
CVE-2026-11536 Unsafe Deserialization in IBM WebSphere Application Server (CVE-2026-11536)
CVE-2026-15969 Unsafe Deserialization in SGLang (CVE-2026-15969)
CVE-2026-12118 Unsafe Deserialization in IBM webMethods Integration (CVE-2026-12118)
CVE-2026-57859 Unsafe Deserialization in e107 (CVE-2026-57859)
CVE-2026-1360 Unsafe Deserialization in BuddyPress (WordPress plugin) (CVE-2026-1360)
CVE-2026-65883 Unsafe Deserialization in Aimy Captcha-Less Form (CVE-2026-65883)
CVE-2026-58163 Unsafe Deserialization in Apache (CVE-2026-58163)
CVE-2026-14974 Unsafe Deserialization in IBM WebSphere Application Server (CVE-2026-14974)
CVE-2026-14512 Unsafe Deserialization in IBM WebSphere Application Server (CVE-2026-14512)
CVE-2026-66713 Unsafe Deserialization in Apache Tomcat (CVE-2026-66713)
CVE-2026-11756 A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE...
CVE-2026-65617 Unsafe Deserialization in JFrog Artifactory package handling (CVE-2026-65617)
CVE-2026-63077 KEV [KEV] Unsafe Deserialization in JetBrains TeamCity (CVE-2026-63077)
CVE-2026-15962 Unsafe Deserialization in Fluent Forms Pro Add On Pack (WordPress plugin) (CVE-2026-15962)
CVE-2026-62263 Unsafe Deserialization in org.openidentityplatform.openam:openam-auth-webauthn (CVE-2026-62263)
CVE-2026-59940 Unsafe Deserialization in seroval (CVE-2026-59940)
CVE-2026-50517 Unsafe Deserialization in M365 Copilot (CVE-2026-50517)
CVE-2026-21655 Unsafe Deserialization in victor (CVE-2026-21655)
CVE-2026-65497 Unsafe Deserialization in Complianz (CVE-2026-65497)
CVE-2026-65493 Unsafe Deserialization in Dokan Pro (CVE-2026-65493)
CVE-2026-59544 Unsafe Deserialization in Thrive Quiz Builder (CVE-2026-59544)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details