目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

CWE-502 可信数据的反序列化 类漏洞列表 1687

CWE-502 可信数据的反序列化 类弱点 1687 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-502 指反序列化不可信数据漏洞，属于数据验证缺陷。攻击者通过构造恶意序列化对象，在系统反序列化时触发任意代码执行或拒绝服务。开发者应避免直接反序列化外部输入，改用 JSON 等安全格式，或实施严格的类白名单校验与完整性检查，确保反序列化过程仅处理预期类型，从而阻断恶意载荷执行。

MITRE CWE 官方描述
CWE：CWE-502 反序列化不可信数据 (Deserialization of Untrusted Data) 英文：产品在没有充分确保生成的数据有效性的情况下，对不可信数据进行反序列化。
常见影响 (3)
IntegrityModify Application Data, Unexpected State
Attackers can modify unexpected objects or data that was assumed to be safe from modification. Deserialized data or code could be modified without using the provided accessor functions, or unexpected functions could be invoked.
AvailabilityDoS: Resource Consumption (CPU)
If a function is making an assumption on when to terminate, based on a sentry in a string, it could easily never terminate.
OtherVaries by Context
The consequences can vary widely, because it depends on which objects or methods are being deserialized, and how they are used. Making an assumption that the code in the deserialized object is valid is dangerous and can enable exploitation. One example is attackers using gadget chains to perform una…
缓解措施 (5)
Architecture and Design, ImplementationIf available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
ImplementationWhen deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
ImplementationExplicitly define a final object() to prevent deserialization.
Architecture and Design, ImplementationMake fields transient to protect them from deserialization. An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.
ImplementationAvoid having unnecessary types or gadgets (a sequence of instances and method invocations that can self-execute during the deserialization process, often found in libraries) available that can be leveraged for malicious ends. This limits the potential for unintended or unauthorized types and gadgets to be leveraged by the attacker. Add only acceptable classes to an allowlist. Note: new gadgets are…
代码示例 (2)
This code snippet deserializes an object from a file and uses it as a UI button:
try { File file = new File("object.obj"); ObjectInputStream in = new ObjectInputStream(new FileInputStream(file)); javax.swing.JButton button = (javax.swing.JButton) in.readObject(); in.close(); }
Bad · Java
private final void readObject(ObjectInputStream in) throws java.io.IOException { throw new java.io.IOException("Cannot be deserialized"); }
Good · Java
In Python, the Pickle library handles the serialization and deserialization processes. In this example derived from [REF-467], the code receives and parses data, and afterwards tries to authenticate a user based on validating a token.
try { class ExampleProtocol(protocol.Protocol): def dataReceived(self, data): # Code that would be here would parse the incoming data # After receiving headers, call confirmAuth() to authenticate def confirmAuth(self, headers): try: token = cPickle.loads(base64.b64decode(headers['AuthToken'])) if not check_hmac(token['signature'], token['data'], getSecretKey()): raise AuthFail self.secure_data = token['data'] except: raise AuthFail }
Bad · Python
CVE ID标题CVSS风险等级Published
CVE-2025-6810 Mescius ActiveReports.NET 代码问题漏洞 — ActiveReports.NET 9.8AICriticalAI2025-07-07
CVE-2025-7099 BoyunCMS 安全漏洞 — BoyunCMS 5.6 Medium2025-07-06
CVE-2025-52828 WordPress plugin Red Art 代码问题漏洞 — Red Art 8.8 High2025-07-04
CVE-2025-49417 WordPress plugin WooCommerce Product Multi-Action 代码问题漏洞 — WooCommerce Product Multi-Action 9.8 Critical2025-07-04
CVE-2025-34067 Hikvision HikCentral 安全漏洞 — Integrated Security Management Platform 9.8AICriticalAI2025-07-02
CVE-2024-13786 WordPress plugin education 代码问题漏洞 — Education Center | LMS & Online Courses WordPress Theme 9.8 Critical2025-07-02
CVE-2025-6464 WordPress plugin Forminator Forms 问题漏洞 — Forminator Forms – Contact Form, Payment Form & Custom Form Builder 7.5 High2025-07-02
CVE-2025-34060 Monero Project Forum 安全漏洞 — Forum 9.8AICriticalAI2025-07-01
CVE-2025-53416 Delta Electronics DTN Soft 安全漏洞 — DTN Soft 7.8 High2025-06-30
CVE-2025-53415 Delta Electronics DTM 安全漏洞 — DTM Soft 7.8 High2025-06-30
CVE-2025-32897 Apache Seata 代码问题漏洞 — Apache Seata (incubating) 9.8AICriticalAI2025-06-28
CVE-2025-53393 Akka 代码问题漏洞 — Akka 6.0 Medium2025-06-28
CVE-2025-28970 WordPress plugin WP Optimize By xTraffic 代码问题漏洞 — WP Optimize By xTraffic 9.8 Critical2025-06-27
CVE-2025-52724 WordPress plugin Amwerk 代码问题漏洞 — Amwerk 9.8 Critical2025-06-27
CVE-2025-52725 WordPress plugin CouponXxL 代码问题漏洞 — CouponXxL 9.8 Critical2025-06-27
CVE-2025-52826 WordPress plugin Sala 代码问题漏洞 — Sala 8.8 High2025-06-27
CVE-2025-52827 WordPress plugin Nuss 代码问题漏洞 — Nuss 8.8 High2025-06-27
CVE-2025-36038 IBM WebSphere Application Server 代码问题漏洞 — WebSphere Application Server 9.0 Critical2025-06-25
CVE-2025-2566 Kaleris NAVIS N4 代码问题漏洞 — Navis N4 9.8AICriticalAI2025-06-24
CVE-2025-25034 SugarCRM 安全漏洞 — SugarCRM 9.8AICriticalAI2025-06-20
CVE-2025-47771 PowSyBl Core 代码问题漏洞 — powsybl-core 8.8AIHighAI2025-06-19
CVE-2025-6279 Upsonic 代码问题漏洞 — Upsonic 5.5 Medium2025-06-19
CVE-2025-30618 WordPress plugin Rapyd Payment Extension for WooCommerce 代码问题漏洞 — Rapyd Payment Extension for WooCommerce 9.8 Critical2025-06-17
CVE-2025-31919 WordPress plugin Spare 代码问题漏洞 — Spare 9.8 Critical2025-06-17
CVE-2025-49331 WordPress plugin eCommerce Product Catalog 代码问题漏洞 — eCommerce Product Catalog 7.2 High2025-06-17
CVE-2025-49330 WordPress plugin Integration for Contact Form 7 and Zoho CRM, Bigin 代码问题漏洞 — Integration for Contact Form 7 and Zoho CRM, Bigin 9.8 Critical2025-06-17
CVE-2025-24919 Dell ControlVault3和Dell ControlVault3 Plus 代码问题漏洞 — BCM5820X 8.1 High2025-06-13
CVE-2025-47166 Microsoft SharePoint 代码问题漏洞 — Microsoft SharePoint Enterprise Server 2016 8.8 High2025-06-10
CVE-2025-47163 Microsoft SharePoint 代码问题漏洞 — Microsoft SharePoint Enterprise Server 2016 8.8 High2025-06-10
CVE-2025-49507 WordPress plugin CozyStay 代码问题漏洞 — CozyStay 9.8 Critical2025-06-10

CWE-502（可信数据的反序列化） 是常见的弱点类别，本平台收录该类弱点关联的 1687 条 CVE 漏洞。