Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 1,305
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801

🛡 Vulnerabilities tagged with this 1,308

Image ID Title
CVE-2026-55083 Unsafe Deserialization in DHIS2 (CVE-2026-55083)
CVE-2026-12544 Unsafe Deserialization in Foreman (CVE-2026-12544)
CVE-2026-97284 Unsafe Deserialization in Icegram (CVE-2026-97284)
CVE-2026-94390 Unsafe Deserialization in Hide Shipping Method For WooCommerce (CVE-2026-94390)
CVE-2026-102135 Unsafe Deserialization in Accellion Kiteworks (CVE-2026-102135)
CVE-2026-102108 Unsafe Deserialization in Accellion Kiteworks (CVE-2026-102108)
CVE-2026-102101 Unsafe Deserialization in Kiteworks Core (CVE-2026-102101)
CVE-2026-97256 Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.
CVE-2026-97291 Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.
CVE-2026-102392 Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product...
CVE-2026-102377 Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.
CVE-2026-100512 Unsafe Deserialization in Nested Pages (CVE-2026-100512)
CVE-2026-103441 Unsafe Deserialization in MediaWiki Wikibase extension (CVE-2026-103441)
CVE-2026-103395 Unsafe Deserialization in LightLLM (CVE-2026-103395)
CVE-2026-97248 Unsafe Deserialization in Booking Activities (CVE-2026-97248)
CVE-2026-97246 Unsafe Deserialization in ShortPixel Image Optimizer (CVE-2026-97246)
CVE-2026-96833 Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.
CVE-2026-96832 Unsafe Deserialization in Content Egg (CVE-2026-96832)
CVE-2026-96831 Unsafe Deserialization in Themify Builder (CVE-2026-96831)
CVE-2026-96343 Unsafe Deserialization in WP ERP (CVE-2026-96343)
CVE-2026-96344 Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.
CVE-2026-95531 Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.
CVE-2026-94677 Unsafe Deserialization in Kadence WooCommerce Email Designer (CVE-2026-94677)
CVE-2026-94683 Unsafe Deserialization in DesignSetGo (CVE-2026-94683)
CVE-2026-94678 Unsafe Deserialization in Go Live Update Urls (CVE-2026-94678)
CVE-2026-94121 Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page...
CVE-2026-94122 Unsafe Deserialization in Responsive Slider Gallery (CVE-2026-94122)
CVE-2026-94076 Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.
CVE-2026-93771 Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.
CVE-2026-93651 Unsafe Deserialization in Minimum (CVE-2026-93651)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details