Weaknesses of type CWE-20

5,454 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2026-47201HIGHauthentik: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated userEPSS 0.3%CVE-2025-58361CRITICALPromptcraft Forge Studio's incomplete URL check is vulnerable to XSS via SVGEPSS 0.3%CVE-2025-12907HIGHInsufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to execute arbitrarEPSS 0.3%CVE-2026-95382MEDIUMImproper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer processEPSS 0.3%CVE-2026-48312MEDIUMCAI Content Credentials | Improper Input Validation (CWE-20)EPSS 0.3%CVE-2024-42175LOWHCL MyXalytics is affected by a weak input validation vulnerabilityEPSS 0.3%CVE-2025-10460CRITICALUnsanitized parameter input leading to SQL Injection vulnerabilityEPSS 0.3%CVE-2026-13877MEDIUMInsufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised thEPSS 0.3%CVE-2026-13875MEDIUMInsufficient validation of untrusted input in GPU in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had comprEPSS 0.3%CVE-2026-9985MEDIUMInsufficient validation of untrusted input in Media in Google Chrome on ChromeOS prior to 148.0.7778.216 allowed a remote attacker who had cEPSS 0.3%CVE-2026-77190MEDIUMSecurity Advisory 0177EPSS 0.3%CVE-2026-13961MEDIUMInsufficient validation of untrusted input in DevTools in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convEPSS 0.3%CVE-2026-9124MEDIUMInsufficient validation of untrusted input in Input in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker who had compromiseEPSS 0.3%CVE-2026-14117MEDIUMInsufficient validation of untrusted input in DevTools in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convEPSS 0.3%CVE-2026-70573HIGHWindows Biometric Service Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-56547LOWAn input reflection vulnerability affects HCL TravelerEPSS 0.3%CVE-2026-8516MEDIUMInsufficient validation of untrusted input in DataTransfer in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced EPSS 0.3%CVE-2025-24785MEDIUMiTop dashboard vulnerable to denial of serviceEPSS 0.3%CVE-2026-10912MEDIUMInsufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromisEPSS 0.3%CVE-2021-1454MEDIUMCisco IOS XE SD-WAN Software Parameter Injection VulnerabilitiesEPSS 0.3%