Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 1,305
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801

🛡 Vulnerabilities tagged with this 1,306

Image ID Title
CVE-2025-61168 Unsafe Deserialization in SIGB PMB (CVE-2025-61168)
CVE-2025-12844 Unsafe Deserialization in AI Engine (WordPress plugin) (CVE-2025-12844)
CVE-2025-12099 Unsafe Deserialization in WordPress (CVE-2025-12099)
CVE-2025-62035 Unsafe Deserialization in Togo (CVE-2025-62035)
CVE-2025-58998 Unsafe Deserialization in s2Member (CVE-2025-58998)
CVE-2025-58592 Unsafe Deserialization in TranslatePress (CVE-2025-58592)
CVE-2025-58619 Unsafe Deserialization in Falang multilanguage (CVE-2025-58619)
CVE-2025-58636 Unsafe Deserialization in WP Gravity Forms Keap/Infusionsoft (CVE-2025-58636)
CVE-2025-54719 Unsafe Deserialization in Yogi - Health Beauty & Yoga (CVE-2025-54719)
CVE-2025-62368 Unsafe Deserialization in Taiga (CVE-2025-62368)
CVE-2025-12305 Vulnerability in quequnlong shiyi-blog (CVE-2025-12305)
CVE-2025-34292 Rox, the software running BeWelcome, contains a PHP object injection vulnerability resulting from deserialization of…
CVE-2025-59287 KEV [KEV] Unsafe Deserialization in Microsoft Windows (CVE-2025-59287)
CVE-2025-62025 Unsafe Deserialization in JobSearch (CVE-2025-62025)
CVE-2025-62008 Unsafe Deserialization in Product Table For WooCommerce (CVE-2025-62008)
CVE-2025-60228 Unsafe Deserialization in Knowledge Base (CVE-2025-60228)
CVE-2025-60232 Unsafe Deserialization in KBx Pro Ultimate (CVE-2025-60232)
CVE-2025-60234 Unsafe Deserialization in Single Property (CVE-2025-60234)
CVE-2025-60221 Unsafe Deserialization in Captivate Sync (CVE-2025-60221)
CVE-2025-60224 Unsafe Deserialization in Subscribe to Download (CVE-2025-60224)
CVE-2025-60225 Unsafe Deserialization in BugsPatrol (CVE-2025-60225)
CVE-2025-60226 Unsafe Deserialization in White Rabbit (CVE-2025-60226)
CVE-2025-60214 Unsafe Deserialization in Goldenblatt (CVE-2025-60214)
CVE-2025-60210 Unsafe Deserialization in Everest Forms - Frontend Listing (CVE-2025-60210)
CVE-2025-60212 Unsafe Deserialization in VEDA (CVE-2025-60212)
CVE-2025-60213 Unsafe Deserialization in Scape (CVE-2025-60213)
CVE-2025-60215 Unsafe Deserialization in Kriya (CVE-2025-60215)
CVE-2025-60216 Unsafe Deserialization in Addison (CVE-2025-60216)
CVE-2025-60209 Unsafe Deserialization in Connector for Gravity Forms and Google Sheets (CVE-2025-60209)
CVE-2025-60039 Unsafe Deserialization in Noisa (CVE-2025-60039)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details