Weaknesses of type CWE-20

5,455 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2026-24856HIGHiccDEV has UB runtime error in <icTagTypeSignature>EPSS 0.3%CVE-2023-45167MEDIUMIBM AIX denial of serviceEPSS 0.3%CVE-2026-78980MEDIUMImproper input validation in ReaderMode in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bEPSS 0.3%CVE-2026-17982MEDIUMInsufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin pEPSS 0.3%CVE-2024-55655LOWsigstore-python has insufficient validation of integration timestamp during verificationEPSS 0.3%CVE-2026-17934MEDIUMInsufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigatioEPSS 0.3%CVE-2026-11659CRITICALInteger overflow in UI in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape vEPSS 0.3%CVE-2026-47132MEDIUMphpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User EnumerationEPSS 0.3%CVE-2026-79105MEDIUMImproper input validation in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to bypass system access restEPSS 0.3%CVE-2026-79015MEDIUMImproper input validation in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restricEPSS 0.3%CVE-2026-8528MEDIUMInsufficient validation of untrusted input in SiteIsolation in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had comprEPSS 0.3%CVE-2022-31607HIGHNVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where a local user with basic capabilitieEPSS 0.3%CVE-2026-17937MEDIUMInsufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigatioEPSS 0.3%CVE-2026-47255HIGHAgenticMail API/storage and outbound relay hardeningEPSS 0.3%CVE-2026-13959MEDIUMInsufficient validation of untrusted input in Blink in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin EPSS 0.3%CVE-2021-26321—Insufficient ID command validation in the SEV Firmware may allow a local authenticated attacker to perform a denial of service of the PSP.EPSS 0.3%CVE-2026-11121MEDIUMInsufficient validation of untrusted input in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised theEPSS 0.3%CVE-2022-24925MEDIUMImproper input validation vulnerability in SettingsProvider prior to Android S(12) allows privileged attackers to trigger a permanent denialEPSS 0.3%CVE-2026-14412HIGHInsufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised thEPSS 0.3%CVE-2026-15757MEDIUMInsufficient input validation vulnerability in NETGEAR DGND3700v1 modem routerEPSS 0.3%