Weaknesses of type CWE-1286

110 results

Validação inadequada da sintaxe de entrada

A aplicação aceita dados de entrada sem verificar se estão sintaticamente corretos conforme o formato esperado (JSON, XML, CSV, expressões regulares, etc.). Isso permite que dados malformados ou injetados passem pela validação e causem comportamentos inesperados: parsing incorreto, execução de lógica não prevista ou até injeção de código.

Example

Um parser JSON que não valida chaves duplicadas ou tipos de dados antes de processar deixa passar um payload malicioso. Ou um formulário que aceita emails sem verificar o símbolo '@', causando erro em operações que assumem formato válido.

How to mitigate

Sempre validar entrada contra um schema ou padrão esperado (whitelist) antes de processar: use bibliotecas de parsing robustas com validação integrada, implemente regex ou schema validation (JSONSchema, etc.), e teste com entradas malformadas. Rejeitar (não apenas limpar) dados sintaticamente inválidos.

CVE-2025-36262MEDIUMIBM Planning Analytics Local information disclosureEPSS 0.3%CVE-2023-44204MEDIUMJunos OS and Junos OS Evolved: The rpd will crash upon receiving a malformed BGP UPDATE messageEPSS 0.3%CVE-2023-21405MEDIUMDenial-of-Service vulnerability in Axis Network Door Controller's and Axis Network Intercom's OSDP communicationEPSS 0.3%CVE-2024-6284MEDIUMImproper IPv4 and IPv6 byte order storage in github.com/google/nftablesEPSS 0.3%CVE-2020-16220—Philips Patient Monitoring Devices Improper Validation of Syntactic Correctness of InputEPSS 0.3%CVE-2025-67492MEDIUMWeblate's over‑permissive webhook endpoint enables mass repository updates and component enumerationEPSS 0.3%CVE-2021-4479MEDIUMDräger Atlan A350 1.00 <= 1.01 DoS via Medibus InterfaceEPSS 0.2%CVE-2019-25723MEDIUMDräger Perseus A500 2.00-2.02 DoS via Medibus InterfaceEPSS 0.2%CVE-2026-0983HIGHDenial of service vulnerability in M-Files ServerEPSS 0.2%CVE-2026-3632LOWLibsoup: libsoup: http smuggling and server-side request forgery via malformed hostnamesEPSS 0.2%CVE-2023-6950LOWAn Improper Input Validation vulnerability affecting the FTP service running on the DJI Mavic Mini 3 Pro could allow an attacker to craft a EPSS 0.2%CVE-2026-55767MEDIUMGuzzle: Dot-Only Cookie Domains Match All Hosts in guzzlehttp/guzzleEPSS 0.2%CVE-2025-59785MEDIUMAPI - Insufficient Input ValidationEPSS 0.2%CVE-2024-26507HIGHAn issue in FinalWire AIRDA Extreme, AIDA64 Engineer, AIDA64 Business, AIDA64 Network Audit through 7.00.6742 allows a local attacker to escEPSS 0.2%CVE-2026-34835MEDIUMRack: `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass.EPSS 0.2%CVE-2019-25720HIGHDräger SC Monitoring Devices DoS via Malformed Network PacketEPSS 0.2%CVE-2026-109425MEDIUMTink-go 2.8.0 Keyset Validation Bypass via NewHandleWithNoSecretsEPSS 0.2%CVE-2025-13995MEDIUMIBM QRadar SIEM Information DisclosureEPSS 0.2%CVE-2025-13327MEDIUMUv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentialsEPSS 0.2%CVE-2025-43878HIGHF5OS-A/C CLI vulnerabilityEPSS 0.2%