Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 1,305
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801

🛡 Vulnerabilities tagged with this 1,306

Image ID Title
CVE-2025-15117 Vulnerability in Dromara Sa-Token (CVE-2025-15117)
CVE-2025-68038 Unsafe Deserialization in Icegram Express Pro (CVE-2025-68038)
CVE-2025-34449 Unsafe Deserialization in Genymobile/scrcpy (CVE-2025-34449)
CVE-2025-63951 Unsafe Deserialization in MiczFlor RPi-Jukebox-RFID project (CVE-2025-63951)
CVE-2025-63950 Unsafe Deserialization in Tomaszdunia (CVE-2025-63950)
CVE-2025-64227 Unsafe Deserialization in Client Invoicing by Sprout Invoices (CVE-2025-64227)
CVE-2025-64233 Unsafe Deserialization in Codiqa (CVE-2025-64233)
CVE-2025-60083 Unsafe Deserialization in PDF Invoice Builder for WooCommerce (CVE-2025-60083)
CVE-2025-67748 Code Injection in fickling (CVE-2025-67748)
CVE-2025-9121 Unsafe Deserialization in Pentaho Data Integration (CVE-2025-9121)
CVE-2025-65213 Unsafe Deserialization in MooreThreads torch_musa through all (CVE-2025-65213)
CVE-2025-14606 Vulnerability in tiny-rdm Tiny RDM (CVE-2025-14606)
CVE-2025-14476 Unsafe Deserialization in Doubly – Cross Domain Copy Paste for (WordPress plugin) (CVE-2025-14476)
CVE-2025-26866 Unsafe Deserialization in Apache (CVE-2025-26866)
CVE-2025-14044 Unsafe Deserialization in Visitor Logic Lite (WordPress plugin) (CVE-2025-14044)
CVE-2025-67779 Unsafe Deserialization in Facebook (CVE-2025-67779)
CVE-2025-55184 Unsafe Deserialization in React Server Components (CVE-2025-55184)
CVE-2025-34394 Unsafe Deserialization in Barracuda (CVE-2025-34394)
CVE-2025-9571 Unsafe Deserialization in Google Cloud Data Fusion (CVE-2025-9571)
CVE-2025-61810 Unsafe Deserialization in Adobe Coldfusion (CVE-2025-61810)
CVE-2025-66214 Unsafe Deserialization in Wearefrank (CVE-2025-66214)
CVE-2025-34414 Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior…
CVE-2025-33213 Unsafe Deserialization in NVIDIA Merlin Transformers4Rec for Linux (CVE-2025-33213)
CVE-2025-33214 Unsafe Deserialization in NVIDIA NVTabular for Linux (CVE-2025-33214)
CVE-2025-67535 Unsafe Deserialization in WordPress WP Maps (CVE-2025-67535)
CVE-2025-66631 Unsafe Deserialization in Cslanet (CVE-2025-66631)
CVE-2025-42928 Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to…
CVE-2025-63721 Unsafe Deserialization in HummerRisk thru (CVE-2025-63721)
CVE-2025-55182 KEV [KEV] Unsafe Deserialization in Meta React Server Components (CVE-2025-55182)
CVE-2025-13805 Vulnerability in nutzam NutzBoot (CVE-2025-13805)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details