Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 1,305
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801

🛡 Vulnerabilities tagged with this 1,308

Image ID Title
CVE-2026-56304 Unsafe Deserialization in picklescan (CVE-2026-56304)
CVE-2026-48909 SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without...
CVE-2026-54499 Unsafe Deserialization in stanza (CVE-2026-54499)
CVE-2026-49286 Unsafe Deserialization in pontedilana/php-weasyprint (CVE-2026-49286)
CVE-2026-12046 Vulnerability in Pgadmin (CVE-2026-12046)
CVE-2026-8024 A remote, unauthenticated attacker may exploit a deserialization of untrusted data vulnerability...
CVE-2026-12569 KEV [KEV] Vulnerability in PTC Windchill and FlexPLM (CVE-2026-12569)
CVE-2026-53805 Unsafe Deserialization in NVIDIA Spatial Intelligence Lab (CVE-2026-53805)
CVE-2026-53874 Unsafe Deserialization in picklescan (CVE-2026-53874)
CVE-2025-71321 Unsafe Deserialization in picklescan (CVE-2025-71321)
CVE-2026-49108 Unauthenticated PHP Object Injection in Moderno < 1.43 versions.
CVE-2026-39556 Unsafe Deserialization in Konsept (CVE-2026-39556)
CVE-2026-39442 Unsafe Deserialization in PressMart (CVE-2026-39442)
CVE-2025-69130 Unsafe Deserialization in WordPress (CVE-2025-69130)
CVE-2026-40738 Unsafe Deserialization in Eldon (CVE-2026-40738)
CVE-2026-39445 Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions.
CVE-2026-39560 Unsafe Deserialization in Hiroshi (CVE-2026-39560)
CVE-2026-39576 Unsafe Deserialization in SingleMalt (CVE-2026-39576)
CVE-2026-40756 Unsafe Deserialization in Zoya (CVE-2026-40756)
CVE-2026-40752 Unsafe Deserialization in Manufaktur Solutions (CVE-2026-40752)
CVE-2026-40733 Unsafe Deserialization in ShiftUp (CVE-2026-40733)
CVE-2026-40757 Unsafe Deserialization in Château (CVE-2026-40757)
CVE-2025-60230 Unsafe Deserialization in Barber Shop (CVE-2025-60230)
CVE-2025-60236 Unsafe Deserialization in Creatify (CVE-2025-60236)
CVE-2025-69127 Unsafe Deserialization in Plumbing (CVE-2025-69127)
CVE-2025-60229 Unsafe Deserialization in Lagom (CVE-2025-60229)
CVE-2025-60231 Unsafe Deserialization in Hospital (CVE-2025-60231)
CVE-2025-69111 Unsafe Deserialization in Reisen (CVE-2025-69111)
CVE-2026-54806 Unsafe Deserialization in WP Activity Log (CVE-2026-54806)
CVE-2026-52706 Unsafe Deserialization in JetEngine (CVE-2026-52706)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details