Weaknesses of type CWE-20

5,426 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2022-45113MEDIUMImproper validation of syntactic correctness of input vulnerability exist in Movable Type series. Having a user to access a specially crafteEPSS 0.6%CVE-2023-31203MEDIUMImproper input validation in some OpenVINO Model Server software before version 2022.3 for Intel Distribution of OpenVINO toolkit may allow EPSS 0.6%CVE-2021-1482MEDIUMCisco SD-WAN vManage Authorization Bypass VulnerabilityEPSS 0.6%CVE-2023-21503MEDIUMPotential buffer overflow vulnerability in mm_LteInterRatManagement.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attaEPSS 0.6%CVE-2023-21504MEDIUMPotential buffer overflow vulnerability in mm_Plmncoordination.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackersEPSS 0.6%CVE-2025-5497MEDIUMslackero phpwcms Feedimport processing.inc.php deserializationEPSS 0.6%CVE-2023-39539HIGHFailure when uploading a Logo image fileEPSS 0.6%CVE-2026-74761HIGHApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientIdEPSS 0.6%CVE-2025-31132HIGHRaven allows Remote Code Execution due to improper validationEPSS 0.6%CVE-2026-3204CRITICALImproper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displaEPSS 0.6%CVE-2026-5536MEDIUMFedML-AI FedML gRPC server grpc_server.py sendMessage deserializationEPSS 0.6%CVE-2023-36462MEDIUMMastodon's verified profile links can be formatted in a misleading wayEPSS 0.6%CVE-2023-22898MEDIUMworkers/extractor.py in Pandora (aka pandora-analysis/pandora) 1.3.0 allows a denial of service when an attacker submits a deeply nested ZIPEPSS 0.6%CVE-2022-20545HIGHIn bindArtworkAndColors of MediaControlPanel.java, there is a possible way to crash the phone due to improper input validation. This could lEPSS 0.6%CVE-2022-22247HIGHJunos OS Evolved: Kernel processing of unvalidated TCP segments could lead to a Denial of Service (DoS)EPSS 0.6%CVE-2024-26151HIGHPotentially untrusted input is rendered as HTML in final outputEPSS 0.6%CVE-2026-7195HIGHCWE-20: Improper Input Validation in web services in Progress SitefinityEPSS 0.6%CVE-2023-51931HIGHAn issue in alanclarke URLite v.3.1.0 allows an attacker to cause a denial of service (DoS) via a crafted payload to the parsing function.EPSS 0.6%CVE-2026-25128HIGHfast-xml-parser has RangeError DoS Numeric Entities BugEPSS 0.6%CVE-2023-29026MEDIUMRockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting AttackEPSS 0.6%