Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 1,305
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801

🛡 Vulnerabilities tagged with this 1,308

Image ID Title
CVE-2026-11857 Unsafe Deserialization in Client Update Service (CVE-2026-11857)
CVE-2026-12115 Unsafe Deserialization in WordPress (CVE-2026-12115)
CVE-2026-12256 Unsafe Deserialization in Avada (CVE-2026-12256)
CVE-2025-69108 Unsafe Deserialization in Hot Coffee (CVE-2025-69108)
CVE-2025-69122 Unsafe Deserialization in SeaFood Company (CVE-2025-69122)
CVE-2025-60205 Unsafe Deserialization in ThemeREX Addons (CVE-2025-60205)
CVE-2026-35300 Unsafe Deserialization in Oracle Weblogic Server (CVE-2026-35300)
CVE-2026-48775 Unsafe Deserialization in langgraph-checkpoint (CVE-2026-48775)
CVE-2026-10748 Unsafe Deserialization in Sonatype Nexus Repository Manager (CVE-2026-10748)
CVE-2026-24228 Unsafe Deserialization in NVIDIA NeMo Framework for Linux (CVE-2026-24228)
CVE-2026-48853 Unsafe Deserialization in grpc (CVE-2026-48853)
CVE-2026-49765 Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms,...
CVE-2026-49770 Unsafe Deserialization in WP Travel Engine (CVE-2026-49770)
CVE-2026-49781 Unsafe Deserialization in OttoKit (CVE-2026-49781)
CVE-2026-49768 Unsafe Deserialization in Happyforms (CVE-2026-49768)
CVE-2026-49769 Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.
CVE-2026-9691 Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7,...
CVE-2026-49109 Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms,...
CVE-2026-49085 Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor,...
CVE-2026-49104 Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7,...
CVE-2026-49106 Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1...
CVE-2026-49105 Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor,...
CVE-2026-49763 Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions.
CVE-2026-42687 Unsafe Deserialization in EventPrime (CVE-2026-42687)
CVE-2026-39532 Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.
CVE-2026-39474 Unsafe Deserialization in Post Duplicator (CVE-2026-39474)
CVE-2026-39471 Unsafe Deserialization in ShortPixel Image Optimizer (CVE-2026-39471)
CVE-2026-39478 Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87...
CVE-2026-39472 Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.
CVE-2026-39481 Unsafe Deserialization in Modula Image Gallery (CVE-2026-39481)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details