Weaknesses of type CWE-20

5,888 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2026-39998MEDIUMApache APISIX: Identity Injection via forward-auth Plugin Missing Header CleanupEPSS 0.7%CVE-2023-33217HIGHMissing integrity check on upgrade packageEPSS 0.7%CVE-2026-45135HIGHCaddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP FilesEPSS 0.7%CVE-2024-30092HIGHWindows Hyper-V Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-49097MEDIUMApache Camel: Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to redirect outgoing IRC messages to arbitrary channels or usersEPSS 0.7%CVE-2024-26127LOWAdobe Experience Manager | Improper Input Validation (CWE-20)EPSS 0.7%CVE-2025-21284MEDIUMWindows Virtual Trusted Platform Module Denial of Service VulnerabilityEPSS 0.7%CVE-2025-21280MEDIUMWindows Virtual Trusted Platform Module Denial of Service VulnerabilityEPSS 0.7%CVE-2022-1243HIGHCRHTLF can lead to invalid protocol extraction potentially leading to XSS in medialize/uri.jsEPSS 0.7%CVE-2024-38047HIGHPowerShell Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2025-53652HIGHJenkins Git Parameter Plugin 439.vb_0e46ca_14534 and earlier does not validate that the Git parameter value submitted to the build matches oEPSS 0.7%CVE-2024-12401MEDIUMCert-manager: potential dos when parsing specially crafted pem inputsEPSS 0.7%CVE-2026-23570MEDIUMLog timestamp tampering vulnerability in Content Distribution ServiceEPSS 0.7%CVE-2026-47629HIGHNVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause improper input validation. A successful explEPSS 0.7%CVE-2024-23600LOWPingIDM Query Filter VulnerabilityEPSS 0.7%CVE-2026-40376HIGHVisual Studio Code Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2025-29784HIGHNamelessMC Has Lack of Length Validation for s Parameter in GET RequestsEPSS 0.7%CVE-2026-63421HIGHKeystone: `graphql.maxTake` bypass with negative `take`EPSS 0.7%CVE-2026-90999CRITICALSentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environmentEPSS 0.7%CVE-2024-43526MEDIUMWindows Mobile Broadband Driver Remote Code Execution VulnerabilityEPSS 0.7%