Weaknesses of type CWE-20

5,888 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2024-3029CRITICALImproper Input Validation in mintplex-labs/anything-llmEPSS 0.7%CVE-2024-26253MEDIUMWindows rndismp6.sys Remote Code Execution VulnerabilityEPSS 0.7%CVE-2025-59032HIGHManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedEPSS 0.7%CVE-2021-42117LOWUI Redressing in TopEaseEPSS 0.7%CVE-2019-15997MEDIUMCisco DNA Spaces: Connector Command Injection VulnerabilityEPSS 0.7%CVE-2026-72065CRITICALnet: mana: Validate the packet length reported by the NICEPSS 0.7%CVE-2023-32305HIGHaiven-extras PostgreSQL Privilege Escalation Through Overloaded Search PathEPSS 0.7%CVE-2026-22862HIGHgo-ethereum has a DoS via malicious p2p messageEPSS 0.7%CVE-2022-22508MEDIUMCODESYS V3: Improper Input ValidationEPSS 0.7%CVE-2021-27760MEDIUMHCL Notes 11.0 - 11.0.1 FP4 Sametime Embedded chat clients are vulnerable to group chats loading script on restartEPSS 0.7%CVE-2024-22027MEDIUMImproper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a EPSS 0.7%CVE-2020-3429HIGHCisco IOS XE Wireless Controller Software for the Catalyst 9000 Family WPA Denial of Service VulnerabilityEPSS 0.7%CVE-2017-7509LOWAn input validation error was found in Red Hat Certificate System's handling of client provided certificates before 8.1.20-1. If the certreqEPSS 0.7%CVE-2020-15197MEDIUMDenial of Service in TensorflowEPSS 0.7%CVE-2023-47107HIGHPILOS account takeover through password reset poisoningEPSS 0.7%CVE-2025-1177MEDIUMdayrui XunRuiCMS Linkage.php import_add deserializationEPSS 0.7%CVE-2022-45088CRITICALLocal File Inclusion in Smartpower WebEPSS 0.7%CVE-2020-7870MEDIUMA memory corruption vulnerability exists when ezPDF improperly handles the parameter. This vulnerability exists due to insufficient validatiEPSS 0.7%CVE-2024-45258CRITICALThe req package before 3.43.4 for Go may send an unintended request when a malformed URL is provided, because cleanHost in http.go intentionEPSS 0.7%CVE-2026-47430CRITICALCordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViewsEPSS 0.7%