Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 1,305
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801

🛡 Vulnerabilities tagged with this 1,306

Image ID Title
CVE-2026-20307 Unsafe Deserialization in Cisco ISE (CVE-2026-20307)
CVE-2026-70416 Unsafe Deserialization in Dell ObjectScale (CVE-2026-70416)
CVE-2025-59953 Unsafe Deserialization in lmdeploy (CVE-2025-59953)
CVE-2026-91939 Unsafe Deserialization in Cotonti (CVE-2026-91939)
CVE-2026-12728 Unsafe Deserialization in IBM MQ (CVE-2026-12728)
CVE-2026-11729 Unsafe Deserialization in IBM MQ (CVE-2026-11729)
CVE-2023-54398 Unsafe Deserialization in Yonyou U8 Cloud (CVE-2023-54398)
CVE-2026-91842 Vulnerability in OpenBankProject OBP-API (CVE-2026-91842)
CVE-2026-67399 Unsafe Deserialization in WHMCS (CVE-2026-67399)
CVE-2026-13293 Unsafe Deserialization in IBM MQ (CVE-2026-13293)
CVE-2026-17416 Unsafe Deserialization in IBM App Connect Enterprise (CVE-2026-17416)
CVE-2026-17156 Unsafe Deserialization in IBM App Connect Enterprise (CVE-2026-17156)
CVE-2026-49400 Unsafe Deserialization in october/system (CVE-2026-49400)
CVE-2026-61701 Unsafe Deserialization in Laravel (CVE-2026-61701)
CVE-2026-90919 Unsafe Deserialization in LightLLM (CVE-2026-90919)
CVE-2026-90614 Vulnerability in FedML-AI FedML (CVE-2026-90614)
CVE-2026-90575 Vulnerability in PHPGurukul Small CRM (CVE-2026-90575)
CVE-2026-90777 Unsafe Deserialization in ESPnet (CVE-2026-90777)
CVE-2026-90490 Vulnerability in lenve vhr (CVE-2026-90490)
CVE-2026-78006 Unsafe Deserialization in Events Calendar (WordPress plugin) (CVE-2026-78006)
CVE-2026-78175 Unsafe Deserialization in Tutor LMS – eLearning and online course solution (WordPress plugin) (CVE-2026-78175)
CVE-2026-84099 Unsafe Deserialization in wpstorecart (WordPress plugin) (CVE-2026-84099)
CVE-2026-82845 Unsafe Deserialization in Masteriyo LMS (WordPress plugin) (CVE-2026-82845)
CVE-2026-87719 Unsafe Deserialization in Gitlab (CVE-2026-87719)
CVE-2026-62103 Unsafe Deserialization in Everest Forms (CVE-2026-62103)
CVE-2026-62105 Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.
CVE-2026-62107 Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions.
CVE-2026-73699 Unsafe Deserialization in FileRun (CVE-2026-73699)
CVE-2026-81784 Unsafe Deserialization in Wise Chat (CVE-2026-81784)
CVE-2026-82925 Unsafe Deserialization in Site Reviews (WordPress plugin) (CVE-2026-82925)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details