Weaknesses of type CWE-183

57 results

Lista Permissiva de Entradas Permitidas

Ocorre quando uma aplicação define uma lista de entradas 'seguras' ou permitidas que é demasiado aberta, deixando passar dados malformados ou maliciosos que não deveriam ser aceitos. O risco está em validar por uma whitelist fraca, assumindo que tudo dentro dela é inofensivo quando na verdade comportamentos perigosos conseguem passar.

Example

Uma API permite apenas domínios de email em uma whitelist (ex: 'example.com', 'empresa.com'), mas a regex usada é mal configurada e aceita também 'example.com.atacante.com' ou '.example.com'; um usuário autenticado indevidamente consegue registrar-se ou fazer bypass de verificações.

How to mitigate

Use validação por blacklist combinada com whitelist restrita, ou melhor ainda: valide por padrão rigoroso (regex exato ou parsing estruturado). Teste a whitelist com casos extremos e variações (subdomínios, caracteres especiais, null bytes) antes de deploy. Revise periodicamente o escopo da lista permitida.

CVE-2026-116339MEDIUMiFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklistEPSS 0.5%CVE-2026-106510HIGHBackstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.ymlEPSS 0.5%CVE-2026-15625MEDIUMnextlevelbuilder GoClaw exec_approval.go ExecApprovalManager.CheckCommand incomplete blacklistEPSS 0.5%CVE-2026-54694CRITICALNationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account TakeoverEPSS 0.5%CVE-2026-46391HIGHHAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apisEPSS 0.5%CVE-2026-67315MEDIUMaxios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0EPSS 0.5%CVE-2026-55581HIGHmcp-shell: Secure Mode Allowlist Bypass via Default `/bin/bash` ExecutableEPSS 0.5%CVE-2026-12974HIGHSecurity Policy Bypass in Forcepoint Security Engine (NGFW)EPSS 0.5%CVE-2022-42469MEDIUMA permissive list of allowed inputs vulnerability [CWE-183] in FortiGate version 7.2.3 and below, version 7.0.9 and below Policy-based NGFW EPSS 0.4%CVE-2026-103687MEDIUMrhukster dom-sanitizer SVG Sanitization DOMSanitizer.php url incomplete blacklistEPSS 0.4%CVE-2022-34450MEDIUM PowerPath Management Appliance with version 3.3 contains Privilege Escalation vulnerability. An authenticated admin user could potentially EPSS 0.4%CVE-2026-90808MEDIUMHKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklistEPSS 0.4%CVE-2026-113786LOWpypdf: Unvalidated JPEG image data loadingEPSS 0.4%CVE-2026-32881MEDIUMewe has an Overly Permissive List of Allowed InputsEPSS 0.4%CVE-2026-46608HIGHGlances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)EPSS 0.4%CVE-2026-33979HIGHExpress XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)EPSS 0.4%CVE-2026-40899HIGHDataEase has an Arbitrary File Read VulnerabilityEPSS 0.4%CVE-2024-47565MEDIUMA vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly validate tEPSS 0.4%CVE-2024-38522MEDIUMCSP bypass in Hush LineEPSS 0.3%CVE-2026-66005MEDIUMJan Local API Server CORS Origin Reflection via 0.0.0.0 BindingEPSS 0.3%