Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 1,305
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801

🛡 Vulnerabilities tagged with this 1,305

Image ID Title
CVE-2026-93937 Unsafe Deserialization in Hygia (CVE-2026-93937)
CVE-2026-93936 Unsafe Deserialization in IPharm (CVE-2026-93936)
CVE-2026-93932 Unsafe Deserialization in Smart Casa (CVE-2026-93932)
CVE-2026-93931 Unsafe Deserialization in Smash (CVE-2026-93931)
CVE-2026-93927 Unsafe Deserialization in Veto (CVE-2026-93927)
CVE-2026-93929 Unsafe Deserialization in Travesia (CVE-2026-93929)
CVE-2026-93930 Unsafe Deserialization in Tantra (CVE-2026-93930)
CVE-2026-93935 Unsafe Deserialization in Let's Play (CVE-2026-93935)
CVE-2026-93933 Unsafe Deserialization in Rosalinda (CVE-2026-93933)
CVE-2026-93934 Unsafe Deserialization in Partiso (CVE-2026-93934)
CVE-2026-62046 Unsafe Deserialization in Gutentype (CVE-2026-62046)
CVE-2026-106606 Unsafe Deserialization in YITH WooCommerce Affiliates (CVE-2026-106606)
CVE-2026-62045 Unsafe Deserialization in Booklovers (CVE-2026-62045)
CVE-2026-12626 Unsafe Deserialization in Online Scheduling and Appointment Booking System – Bookly (WordPress plugin) (CVE-2026-12626)
CVE-2026-104723 Unsafe Deserialization in WordPress (CVE-2026-104723)
CVE-2026-102554 Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava…
CVE-2026-94065 Unsafe Deserialization in ColorFolio (CVE-2026-94065)
CVE-2026-94064 Unsafe Deserialization in Neo | Barber Shop WordPress Theme (CVE-2026-94064)
CVE-2026-100730 A service console interface on openPDC and openHistorian deserializes a client-supplied data...
CVE-2026-105872 Unsafe Deserialization in Product Configurator for WooCommerce (CVE-2026-105872)
CVE-2026-104392 Unsafe Deserialization in Quiz And Survey Master (CVE-2026-104392)
CVE-2026-94568 Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce...
CVE-2026-88131 Unsafe Deserialization in Microsoft Dataverse (CVE-2026-88131)
CVE-2026-78401 Unsafe Deserialization in IBM Security Verify Access (CVE-2026-78401)
CVE-2026-78406 Unsafe Deserialization in IBM Security Verify Access (CVE-2026-78406)
CVE-2026-105436 Unsafe Deserialization in MainWP Child (CVE-2026-105436)
CVE-2026-93034 Unsafe Deserialization in SGLang (CVE-2026-93034)
CVE-2026-82627 Unsafe Deserialization in WordPress (CVE-2026-82627)
CVE-2026-95606 Unsafe Deserialization in Events Calendar (CVE-2026-95606)
CVE-2026-95534 Unsafe Deserialization in Unlimited Elements For Elementor (CVE-2026-95534)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details