Weaknesses of type CWE-20

5,889 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2026-26314HIGHGo Ethereum affected by DoS via malicious p2p messageEPSS 0.7%CVE-2021-34597HIGHPhoenix Contact: PC Worx/-Express prone to improper input validation vulnerabilityEPSS 0.7%CVE-2025-31215MEDIUMThe issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.EPSS 0.7%CVE-2023-36860HIGHImproper input validation for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via nEPSS 0.7%CVE-2020-29021LOWScripting tag chars < > not filtered in input fields could cause Cross-Site Scripting (XSS)EPSS 0.7%CVE-2024-25046MEDIUMIBM Db2 for Linux, UNIX and Windows denial of serviceEPSS 0.7%CVE-2024-22360MEDIUMIBM Db2 for Linux, UNIX and Windows denial of serviceEPSS 0.7%CVE-2024-27254MEDIUMIBM Db2 for Linux, UNIX and Windows denial of serviceEPSS 0.7%CVE-2024-49753MEDIUMDenied Host Validation Bypass in Zitadel ActionsEPSS 0.7%CVE-2023-3724CRITICALTLS 1.3 client issue handling malicious server when not including a KSE and PSK extensionEPSS 0.7%CVE-2024-4609HIGHRockwell Automation Datalog Function within in FactoryTalk® View SE contains SQL Injection VulnerabilityEPSS 0.7%CVE-2022-2232HIGHKeycloak: ldap injection on username inputEPSS 0.7%CVE-2023-34239HIGHUnfiltered paths in gradioEPSS 0.7%CVE-2024-29042MEDIUMTranslate Cache Poisoning VulnerabilityEPSS 0.7%CVE-2024-32669MEDIUMPossible stack overflow due to a string encoding processing errorEPSS 0.6%CVE-2025-21375HIGHKernel Streaming WOW Thunk Service Driver Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2024-20405MEDIUMA vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a stored XEPSS 0.6%CVE-2026-12954HIGHMapster WP Maps <= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' ParameterEPSS 0.6%CVE-2022-45113MEDIUMImproper validation of syntactic correctness of input vulnerability exist in Movable Type series. Having a user to access a specially crafteEPSS 0.6%CVE-2024-38201HIGHAzure Stack Hub Elevation of Privilege VulnerabilityEPSS 0.6%