Weaknesses of type CWE-20

5,450 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2024-5969MEDIUMAIomatic - Automatic AI Content Writer <= 2.0.5 - Unauthenticated Arbitrary Email SendingEPSS 0.3%CVE-2026-33948LOWjq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed InputEPSS 0.3%CVE-2026-28917MEDIUMThe issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOEPSS 0.3%CVE-2022-29204MEDIUMMissing validation causes denial of service in TensorFlow via `Conv3DBackpropFilterV2`EPSS 0.3%CVE-2025-13909MEDIUMInformation Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII ExposureEPSS 0.3%CVE-2026-13926MEDIUMInsufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised EPSS 0.3%CVE-2026-86768MEDIUMSnipe-IT before 8.7.0 Improper Input Validation via API CheckoutEPSS 0.3%CVE-2026-13921MEDIUMInsufficient validation of untrusted input in DeviceBoundSessionCredentials in Google Chrome prior to 150.0.7871.47 allowed a remote attackeEPSS 0.3%CVE-2026-11914MEDIUMComposer - Critical - Unsupported - SA-CONTRIB-2026-046EPSS 0.3%CVE-2026-14065MEDIUMInsufficient validation of untrusted input in PageInfo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromisedEPSS 0.3%CVE-2026-76758MEDIUMLink content parser - Critical - Unsupported - SA-CONTRIB-2026-101EPSS 0.3%CVE-2026-14023MEDIUMInsufficient validation of untrusted input in SanitizerAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same EPSS 0.3%CVE-2026-13924MEDIUMInsufficient validation of untrusted input in WebView in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had cEPSS 0.3%CVE-2026-53723MEDIUMguzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA TerminatorEPSS 0.3%CVE-2026-9210MEDIUMCertain NETGEAR routers allow authenticated administrators to gain unintended control of the routerEPSS 0.3%CVE-2026-29141HIGHBounded Subject Tag SanitizationEPSS 0.3%CVE-2026-13791HIGHInsufficient validation of untrusted input in Downloads in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to EPSS 0.3%CVE-2026-29144HIGHUnicode Subject TagsEPSS 0.3%CVE-2018-0337—A vulnerability in the role-based access-checking mechanisms of Cisco NX-OS Software could allow an authenticated, local attacker to executeEPSS 0.3%CVE-2022-21212MEDIUMImproper input validation for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial of EPSS 0.3%