Weaknesses of type CWE-1287

160 results

Validação inadequada do tipo de entrada especificado

O software aceita dados de entrada sem verificar corretamente se correspondem ao tipo esperado (inteiro, string, booleano, etc.), permitindo que dados malformados ou de tipo inesperado sejam processados. Isso pode levar a comportamentos imprevisto, injeção de código, corrupção de dados ou bypass de controles de segurança.

Example

Uma API que espera um inteiro em um parâmetro de ID de usuário, mas não valida o tipo antes de usar: um atacante envia uma string contendo SQL ('1 OR 1=1') em vez de um número, causando injeção SQL. Ou uma função JavaScript que recebe um objeto esperando propriedades numéricas, mas aceita strings sem conversão, quebrando a lógica de negócio.

How to mitigate

Implemente validação explícita de tipo antes de processar qualquer entrada: use type checking, conversão segura com tratamento de erro, esquemas (como JSON Schema), e rejeite dados que não correspondam ao tipo esperado. Em linguagens fortemente tipadas, configure validadores em tempo de compilação; em linguagens dinâmicas, valide em runtime com bibliotecas apropriadas.

CVE-2026-0802MEDIUMAn ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalatEPSS 0.4%CVE-2022-22168MEDIUMJunos OS: vMX and MX150: Specific packets might cause a memory leak and eventually an FPC rebootEPSS 0.4%CVE-2025-20327HIGHA vulnerability in the web UI of Cisco IOS Software could allow an authenticated, remote attacker with low privileges to cause a denial of sEPSS 0.4%CVE-2026-86287HIGHNet::IP::LPM versions before 1.12 for Perl accept malformed prefix lengthsEPSS 0.4%CVE-2025-59277HIGHWindows Authentication Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-0325MEDIUMA Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to EPSS 0.4%CVE-2026-20119HIGHCisco TelePresence Collaboration Endpoint Software and RoomOS Software Denial of Service VulnerabilityEPSS 0.4%CVE-2024-47261MEDIUM51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have sufficient input validEPSS 0.4%CVE-2025-1558MEDIUMDenial of Service Via Malicious GIFEPSS 0.4%CVE-2023-47726HIGHIBM QRadar Suite improper input validationEPSS 0.4%CVE-2025-40911MEDIUMNet::CIDR::Set versions 0.10 through 0.13 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addressesEPSS 0.4%CVE-2025-0476MEDIUMMobile crash via file with specially crafted filenameEPSS 0.4%CVE-2023-32651MEDIUMImproper validation of specified type of input for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.24EPSS 0.4%CVE-2024-47262MEDIUMDzmitry Lukyanenka, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API param.cgi was vulnerable to a race condition attaEPSS 0.4%CVE-2025-60633MEDIUMAn issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via the Nudm_SubscriberDataManagementEPSS 0.4%CVE-2025-10207HIGHAuthenticated File Disclosure/DeleteEPSS 0.4%CVE-2023-47727MEDIUMIBM QRadar Suite Software file manipulationEPSS 0.3%CVE-2026-9742HIGHAuthenticate command with specific mechanism parameter can trigger server crashEPSS 0.3%CVE-2026-89207MEDIUMA vulnerability has been identified in WTV676-HB6035 Web Interface (All versions < V3.94), WTV776-HB6035 Web Interface (All versions < V4.17EPSS 0.3%CVE-2025-54525HIGHUnexpected input to Create Channel Subscription endpoint causes DoS in Mattermost Confluence PluginEPSS 0.3%