Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 1,305
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801

🛡 Vulnerabilities tagged with this 1,306

Image ID Title
CVE-2025-59007 Unsafe Deserialization in TF Woo Product Grid Addon For Elementor (CVE-2025-59007)
CVE-2025-52740 Unsafe Deserialization in Boldermail (CVE-2025-52740)
CVE-2025-52737 Unsafe Deserialization in WP Store Locator (CVE-2025-52737)
CVE-2025-49380 Unsafe Deserialization in WooCommerce Vehicle Parts Finder (CVE-2025-49380)
CVE-2025-31634 Unsafe Deserialization in Insurance (CVE-2025-31634)
CVE-2025-32283 Unsafe Deserialization in Solar Energy (CVE-2025-32283)
CVE-2025-62515 Unsafe Deserialization in pyquokka (CVE-2025-62515)
CVE-2025-54539 Unsafe Deserialization in Apache (CVE-2025-54539)
CVE-2025-59285 Unsafe Deserialization in Azure Monitor Agent (CVE-2025-59285)
CVE-2025-11622 Unsafe Deserialization in Ivanti Endpoint Manager (CVE-2025-11622)
CVE-2025-35050 Vulnerability in Newforma (CVE-2025-35050)
CVE-2025-35051 Vulnerability in Newforma (CVE-2025-35051)
CVE-2025-60828 Unsafe Deserialization in 5Kcrm (CVE-2025-60828)
CVE-2025-11273 Vulnerability in LaChatterie Verger (CVE-2025-11273)
CVE-2025-61622 Unsafe Deserialization in pyfory (CVE-2025-61622)
CVE-2025-11135 Vulnerability in pmTicket Project-Management-Software (CVE-2025-11135)
CVE-2025-10035 KEV [KEV] Unsafe Deserialization in Fortra GoAnywhere MFT (CVE-2025-10035)
CVE-2025-10975 Vulnerability in GuanxingLu vlarl (CVE-2025-10975)
CVE-2025-10974 Vulnerability in giantspatula SewKinect (CVE-2025-10974)
CVE-2025-10965 Vulnerability in LazyAGI LazyLLM (CVE-2025-10965)
CVE-2025-48459 Unsafe Deserialization in org.apache.iotdb:iotdb-confignode (CVE-2025-48459)
CVE-2025-58662 Unsafe Deserialization in Awesome Support (CVE-2025-58662)
CVE-2025-6544 Unsafe Deserialization in ai.h2o:h2o-core (CVE-2025-6544)
CVE-2025-10768 Vulnerability in h2oai h2o-3 (CVE-2025-10768)
CVE-2025-5086 KEV [KEV] Unsafe Deserialization in Dassault Systèmes DELMIA Apriso (CVE-2025-5086)
CVE-2025-53303 Unsafe Deserialization in ThemeMove Core (CVE-2025-53303)
CVE-2025-53690 KEV [KEV] Unsafe Deserialization in Sitecore Multiple Products (CVE-2025-53690)
CVE-2025-54742 Unsafe Deserialization in WpEvently (CVE-2025-54742)
CVE-2025-53583 Unsafe Deserialization in Employee Spotlight (CVE-2025-53583)
CVE-2025-53584 Unsafe Deserialization in WordPress (CVE-2025-53584)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details