Filtered by vendor Zaproxy Subscriptions
Total 1 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-57527 1 Zaproxy 1 Zap-extensions 2026-06-29 8.8 High
Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who control a proxied web server to achieve arbitrary code execution by embedding a malicious serialized Java object in the javax.faces.ViewState HTTP response parameter. The JSFViewState.decode() method base64-decodes the ViewState value and passes it directly to ObjectInputStream.readObject() without a deserialization filter, allowlist, or type restriction, causing the malicious object to be deserialized within the ZAP JVM when the Desktop UI renders the ViewState panel.