Weaknesses of type CWE-20

5,891 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2026-32177HIGH.NET Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2023-31013MEDIUMNVIDIA DGX H100 BMC contains a vulnerability in the REST service, where an attacker may cause improper input validation. A successful exploiEPSS 0.6%CVE-2023-31012MEDIUMNVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation. A successful exploitEPSS 0.6%CVE-2020-3390HIGHCisco IOS XE Wireless Controller Software for the Catalyst 9000 Family SNMP Trap Denial of Service VulnerabilityEPSS 0.6%CVE-2025-31132HIGHRaven allows Remote Code Execution due to improper validationEPSS 0.6%CVE-2023-28113MEDIUMrussh may use insecure Diffie-Hellman keysEPSS 0.6%CVE-2025-61920HIGHAuthlib is vulnerable to Denial of Service via Oversized JOSE SegmentsEPSS 0.6%CVE-2023-48311HIGHAny image allowed by defaultEPSS 0.6%CVE-2025-48490MEDIUMLaravel Rest Api has a Search Validation BypassEPSS 0.6%CVE-2023-0751MEDIUMGELI silently omits the keyfile if read from stdinEPSS 0.6%CVE-2024-11737CRITICALCWE-20: Improper Input Validation vulnerability exists that could lead to a denial of service and a loss of confidentiality, integrity of thEPSS 0.6%CVE-2024-3493HIGHRockwell Automation ControlLogix and GaurdLogix Vulnerable to Major Nonrecoverable Fault Due to Invalid Header ValueEPSS 0.6%CVE-2023-27487HIGHEnvoy client may fake the header `x-envoy-original-path`EPSS 0.6%CVE-2026-33332MEDIUMNiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustionEPSS 0.6%CVE-2023-20525MEDIUMInsufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory outside the bounds of a mapped reEPSS 0.6%CVE-2026-71217HIGHIperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustionEPSS 0.6%CVE-2026-56398HIGHOpen WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URIEPSS 0.6%CVE-2023-20527MEDIUMImproper syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory out-of-bounds, potentially leading toEPSS 0.6%CVE-2024-20484HIGHCisco Enterprise Chat and Email Denial of Service VulnerabilityEPSS 0.6%CVE-2023-41336MEDIUMPrevent injection of invalid entity ids for "autocomplete" fields in symfony ux-autocompleteEPSS 0.6%