Weaknesses of type CWE-20

5,888 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2022-51015HIGHPocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacketEPSS 0.7%CVE-2026-96620CRITICALClaude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command ExecutionEPSS 0.7%CVE-2026-58186HIGHApache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responsesEPSS 0.7%CVE-2026-48055CRITICALStreambert: Arbitrary File Write (Zip Slip) via Subtitle ExtractionEPSS 0.7%CVE-2023-45177MEDIUMIBM MQ denial of serviceEPSS 0.7%CVE-2023-35944HIGHEnvoy vulnerable to incorrect handling of HTTP requests and responses with mixed case schemesEPSS 0.7%CVE-2025-1767MEDIUMThis CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same EPSS 0.7%CVE-2020-3257HIGHCisco IOx Application Environment for IOS Software for Cisco Industrial Routers VulnerabilitiesEPSS 0.7%CVE-2026-82550MEDIUMLinux Foundation Magma NGSetupRequest input validationEPSS 0.7%CVE-2025-58173HIGHFreshRSS vulnerable to authenticated RCE via path traversal inside include()EPSS 0.7%CVE-2024-32371HIGHAn issue in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a regular user account to escalate their privileges and gain aEPSS 0.7%CVE-2023-2455MEDIUMRow security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases whEPSS 0.7%CVE-2020-3507HIGHCisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Remote Code Execution and Denial of Service VulnerabilitiesEPSS 0.7%CVE-2025-5497MEDIUMslackero phpwcms Feedimport processing.inc.php deserializationEPSS 0.7%CVE-2023-49568HIGHMaliciously crafted Git server replies can cause DoS on go-git clientsEPSS 0.7%CVE-2023-41303—Command injection vulnerability in the distributed file system module. Successful exploitation of this vulnerability may cause variables in EPSS 0.7%CVE-2020-16216—Philips Patient Monitoring Devices Improper Input ValidationEPSS 0.7%CVE-2024-25590HIGHCrafted responses can lead to a denial of service due to cache inefficiencies in the RecursorEPSS 0.7%CVE-2026-43777HIGHThis issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6.EPSS 0.7%CVE-2026-50632HIGHApache CXF: JNDI Injection Vulnerability in JMSConfigFactoryEPSS 0.7%