Weaknesses of type CWE-1286

110 results

Validação inadequada da sintaxe de entrada

A aplicação aceita dados de entrada sem verificar se estão sintaticamente corretos conforme o formato esperado (JSON, XML, CSV, expressões regulares, etc.). Isso permite que dados malformados ou injetados passem pela validação e causem comportamentos inesperados: parsing incorreto, execução de lógica não prevista ou até injeção de código.

Example

Um parser JSON que não valida chaves duplicadas ou tipos de dados antes de processar deixa passar um payload malicioso. Ou um formulário que aceita emails sem verificar o símbolo '@', causando erro em operações que assumem formato válido.

How to mitigate

Sempre validar entrada contra um schema ou padrão esperado (whitelist) antes de processar: use bibliotecas de parsing robustas com validação integrada, implemente regex ou schema validation (JSONSchema, etc.), e teste com entradas malformadas. Rejeitar (não apenas limpar) dados sintaticamente inválidos.

CVE-2024-7954CRITICALSPIP porte_plume Plugin Arbitrary PHP ExecutionEPSS 90.1%CVE-2024-51983HIGHUnauthenticated Denial of Service (DoS) via malformed WS-Scan request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.EPSS 11.8%CVE-2024-51982HIGHUnauthenticated Denial of Service (DoS) via malformed PJL request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, and Ricoh.EPSS 10.7%CVE-2025-13878HIGHMalformed BRID/HHIT records can cause named to terminate unexpectedlyEPSS 9.4%CVE-2026-21527MEDIUMMicrosoft Exchange Server Spoofing VulnerabilityEPSS 8.1%CVE-2023-27043MEDIUMThe email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2EPSS 2.5%CVE-2021-28812HIGHCommand Injection Vulnerability in Video StationEPSS 1.6%CVE-2022-1941HIGHOut of Memory issue in ProtocolBuffers for cpp and pythonEPSS 1.5%CVE-2026-42579HIGHNetty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)EPSS 1.0%CVE-2026-72916MEDIUMMastodon: SSRF Protection Bypass via IPv4-compatible IPv6 AddressesEPSS 1.0%CVE-2024-6763LOWJetty URI parsing of invalid authorityEPSS 1.0%CVE-2021-31988—A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and EPSS 1.0%CVE-2025-25007MEDIUMMicrosoft Exchange Server Spoofing VulnerabilityEPSS 0.9%CVE-2021-31987—A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recipEPSS 0.9%CVE-2024-3384HIGHPAN-OS: Firewall Denial of Service (DoS) via Malformed NTLM PacketsEPSS 0.9%CVE-2026-7307HIGHKeycloak: keycloak: denial of service via specially crafted saml inputEPSS 0.9%CVE-2025-22868HIGHUnexpected memory consumption during token parsing in golang.org/x/oauth2EPSS 0.9%CVE-2022-22192HIGHJunos OS Evolved: PTX Series: An attacker can cause a kernel panic by sending a malformed TCP packet to the deviceEPSS 0.8%CVE-2026-25679HIGHIncorrect parsing of IPv6 host literals in net/urlEPSS 0.8%CVE-2024-29041MEDIUMExpress.js Open Redirect in malformed URLsEPSS 0.8%