Weaknesses of type CWE-1286

110 results

Validação inadequada da sintaxe de entrada

A aplicação aceita dados de entrada sem verificar se estão sintaticamente corretos conforme o formato esperado (JSON, XML, CSV, expressões regulares, etc.). Isso permite que dados malformados ou injetados passem pela validação e causem comportamentos inesperados: parsing incorreto, execução de lógica não prevista ou até injeção de código.

Example

Um parser JSON que não valida chaves duplicadas ou tipos de dados antes de processar deixa passar um payload malicioso. Ou um formulário que aceita emails sem verificar o símbolo '@', causando erro em operações que assumem formato válido.

How to mitigate

Sempre validar entrada contra um schema ou padrão esperado (whitelist) antes de processar: use bibliotecas de parsing robustas com validação integrada, implemente regex ou schema validation (JSONSchema, etc.), e teste com entradas malformadas. Rejeitar (não apenas limpar) dados sintaticamente inválidos.

CVE-2025-24347MEDIUMA vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) EPSS 0.5%CVE-2024-21616HIGHJunos OS: MX Series and SRX Series: Processing of a specific SIP packet causes NAT IP allocation to failEPSS 0.5%CVE-2025-24346HIGHA vulnerability in the “Proxy” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to maEPSS 0.5%CVE-2026-25513HIGHFacturaScripts has SQL Injection vulnerability in API ORDER BY ClauseEPSS 0.5%CVE-2026-6918HIGHIn Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message.EPSS 0.5%CVE-2025-54995MEDIUMAsterisk remotely exploitable leak of RTP UDP ports and internal resourcesEPSS 0.5%CVE-2026-102084CRITICALJunos OS: SRX Series: In an ADVPN scenario a malformed message from a peer causes Remote Code ExecutionEPSS 0.5%CVE-2025-0638HIGHRoutinator crashes when illegal characters are present in manifest file namesEPSS 0.5%CVE-2024-52362MEDIUMIBM App Connect Enterprise Certified Container denial of serviceEPSS 0.5%CVE-2024-39542HIGHJunos OS and Junos OS Evolved: A malformed CFM packet or specific transit traffic leads to FPC crashEPSS 0.5%CVE-2026-57026HIGHJunos OS: MX Series with SPC3, SRX Series: Processing of a specifically malformed SIP invite causes a flowd crashEPSS 0.5%CVE-2025-10954MEDIUMVersions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of InputEPSS 0.5%CVE-2026-110675HIGHCpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hvEPSS 0.5%CVE-2026-88009HIGHTraefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access loggingEPSS 0.4%CVE-2024-8772MEDIUM51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable to a race condition EPSS 0.4%CVE-2025-11573HIGHDenial of Service issue in Amazon.IonDotnetEPSS 0.4%CVE-2026-87082HIGHNet::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycodeEPSS 0.4%CVE-2026-0931MEDIUMDenial-of-service vulnerability in M-Files ServerEPSS 0.4%CVE-2026-110759CRITICALText::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parseEPSS 0.4%CVE-2026-21917HIGHJunos OS: SRX Series: Specifically malformed SSL packet causes FPC crashEPSS 0.4%