Weaknesses of type CWE-184

203 results

Lista incompleta de entradas bloqueadas

Ocorre quando um aplicativo tenta bloquear entradas maliciosas usando uma lista de padrões ou valores proibidos, mas a lista é incompleta ou pode ser contornada. Um atacante descobre variações não contempladas (encoding diferente, casos alternativos, caracteres especiais) e consegue passar por uma validação que se supõe segura.

Example

Um formulário bloqueia SQL injection filtrando a palavra 'DROP', mas não 'dr0p', não '/*DROP*/' ou variações com espaços. Um atacante usa uma dessas formas para executar comandos SQL maliciosos que a lista de bloqueio não previu.

How to mitigate

Em vez de listar o que é proibido (blocklist), defina explicitamente o que é permitido (allowlist/whitelist) com validação rígida de formato. Use bibliotecas consolidadas de sanitização e escape específicas para cada contexto (SQL, HTML, JavaScript) — nunca confie em listas de palavras-chave.

CVE-2026-70466MEDIUMA incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 alEPSS 0.3%CVE-2026-84706HIGHAutomation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijacking variables (bash_env/ld_preload) allowing code execution in the execution environmentEPSS 0.3%CVE-2026-33628MEDIUMInvoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line ItemsEPSS 0.3%CVE-2026-32128MEDIUMFastGPT Python Sandbox Bypass of File-Write RestrictionEPSS 0.3%CVE-2026-54070HIGHSiYuan: Stored XSS in Bazaar marketplace via package README event handlersEPSS 0.3%CVE-2026-84714HIGHAutomation-controller: automation-controller: incomplete sanitize_jinja() regex allows jinja template injection into ad-hoc module_args, machine-credential fields, and host names, reaching ansible-core templating in the execution environmentEPSS 0.3%CVE-2026-68921MEDIUMDiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)EPSS 0.3%CVE-2025-58361CRITICALPromptcraft Forge Studio's incomplete URL check is vulnerable to XSS via SVGEPSS 0.3%CVE-2026-56547LOWAn input reflection vulnerability affects HCL TravelerEPSS 0.3%CVE-2026-40077LOWBeszel has an IDOR in hub API endpoints that read system ID from URL parameterEPSS 0.3%CVE-2025-24388LOWUnsafe handling of AJAX callsEPSS 0.3%CVE-2025-67747HIGHFickling has missing detection for marshal.loads and types.FunctionType in unsafe modules listEPSS 0.3%CVE-2026-59261HIGHOpenClaw < 2026.5.28 - Credential Override via Workspace Dotenv FilesEPSS 0.3%CVE-2025-67748HIGHFickling has Code Injection vulnerability via pty.spawn()EPSS 0.3%CVE-2025-61924LOWPrestaShop Checkout Target PayPal merchant account hijacking from backofficeEPSS 0.3%CVE-2023-45593MEDIUMA CWE-184 “Incomplete List of Disallowed Inputs” vulnerability in the embedded Chromium browser (concerning the handling of alternative URLsEPSS 0.3%CVE-2025-67716MEDIUMAuth0 Next.js SDK has Improper Validation of Query ParametersEPSS 0.3%CVE-2026-43991HIGHJunoClaw: plugin-shell shell-injection bypass via substring blocklistEPSS 0.3%CVE-2026-41361MEDIUMOpenClaw < 2026.3.28 - SSRF Guard Bypass via IPv6 Special-Use RangesEPSS 0.3%CVE-2026-18356LOWLimit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Account EmailEPSS 0.3%