Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 1,305
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801

🛡 Vulnerabilities tagged with this 1,308

Image ID Title
CVE-2026-57677 Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce <= 12.10.3...
CVE-2026-27060 Unsafe Deserialization in ARMember Premium (CVE-2026-27060)
CVE-2026-27414 Unsafe Deserialization in Werkstatt (CVE-2026-27414)
CVE-2026-56037 Unsafe Deserialization in Themify Popup (CVE-2026-56037)
CVE-2026-51947 Unsafe Deserialization in Pivotal CRM (CVE-2026-51947)
CVE-2026-55153 Vulnerability in com.mchange:mchange-commons-java (CVE-2026-55153)
CVE-2026-14265 Unsafe Deserialization in Amazon AWS Advanced JDBC Wrapper (CVE-2026-14265)
CVE-2026-58127 Vulnerability in PACSgear MediaWriter (CVE-2026-58127)
CVE-2026-58126 Vulnerability in PACSgear PACS Scan (CVE-2026-58126)
CVE-2026-58025 Code Injection in MediaWiki (CVE-2026-58025)
CVE-2026-24250 Unsafe Deserialization in NVIDIA Megatron Bridge for Linux (CVE-2026-24250)
CVE-2026-24251 Unsafe Deserialization in NVIDIA Megatron Bridge for Linux (CVE-2026-24251)
CVE-2026-24245 Unsafe Deserialization in NVIDIA Megatron Bridge for Linux (CVE-2026-24245)
CVE-2026-24240 Unsafe Deserialization in NVIDIA Megatron Bridge for Linux (CVE-2026-24240)
CVE-2026-24247 Unsafe Deserialization in NVIDIA Megatron Bridge for Linux (CVE-2026-24247)
CVE-2026-24244 Unsafe Deserialization in NVIDIA Megatron Bridge for Linux (CVE-2026-24244)
CVE-2026-24243 Unsafe Deserialization in NVIDIA Megatron Bridge for Linux (CVE-2026-24243)
CVE-2026-57516 Unsafe Deserialization in ray (CVE-2026-57516)
CVE-2026-10538 Messaging consumer functionality allows deserialization of user-controlled data without...
CVE-2026-56700 OS Command Injection in Grav CMS (CVE-2026-56700)
CVE-2025-71374 Unsafe Deserialization in picklescan (CVE-2025-71374)
CVE-2025-71349 Unsafe Deserialization in picklescan (CVE-2025-71349)
CVE-2025-71363 Unsafe Deserialization in picklescan (CVE-2025-71363)
CVE-2025-71350 Unsafe Deserialization in picklescan (CVE-2025-71350)
CVE-2025-71368 Unsafe Deserialization in picklescan (CVE-2025-71368)
CVE-2025-71371 Unsafe Deserialization in picklescan (CVE-2025-71371)
CVE-2026-55223 Unsafe Deserialization in com.mchange:c3p0 (CVE-2026-55223)
CVE-2026-7871 Unsafe Deserialization in Langflow (CVE-2026-7871)
CVE-2026-13759 Unsafe Deserialization in IBM WebSphere Extreme Scale (CVE-2026-13759)
CVE-2026-12240 Unsafe Deserialization in Export User Data (WordPress plugin) (CVE-2026-12240)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details