Weaknesses of type CWE-20

5,455 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2026-11235HIGHInsufficient policy enforcement in Compositing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renEPSS 0.2%CVE-2026-79192MEDIUMImproper input validation in Variations in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin pEPSS 0.2%CVE-2026-12465HIGHObject lifecycle issue in Metrics in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer procesEPSS 0.2%CVE-2026-48308MEDIUMPremiere Pro | Improper Input Validation (CWE-20)EPSS 0.2%CVE-2026-5887MEDIUMInsufficient validation of untrusted input in Downloads in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to bypaEPSS 0.2%CVE-2026-22220MEDIUMImproper Input Validation Leading to DoS on TP-Link Archer BE230EPSS 0.2%CVE-2021-36323HIGHDell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerabiliEPSS 0.2%CVE-2025-0816HIGHCWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious IPV6 packets are senEPSS 0.2%CVE-2025-0815HIGHCWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious ICMPV6 packets are sEPSS 0.2%CVE-2021-36325HIGHDell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerabiliEPSS 0.2%CVE-2023-42826HIGHThe issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing a file may lead to arbitrary code executionEPSS 0.2%CVE-2025-58353HIGHPromptcraft Forge Studio: Complete Sanitizer Bypass Enables XSS via Overlapping PatternsEPSS 0.2%CVE-2026-88774HIGHFeature policy bypass due to improper HTTP URL based expression usageEPSS 0.2%CVE-2024-5681HIGHCWE-20: Improper Input Validation vulnerability exists that could cause local denial-of-service, privilege escalation, and potentially kerneEPSS 0.2%CVE-2026-29791MEDIUMAgentgateway: Missing parameter sanitization in MCP to OpenAPI conversionEPSS 0.2%CVE-2021-36324HIGHDell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerabiliEPSS 0.2%CVE-2025-8582MEDIUMInsufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to spoof the contents oEPSS 0.2%CVE-2021-26327—Insufficient validation of guest context in the SNP Firmware could lead to a potential loss of guest confidentiality.EPSS 0.2%CVE-2025-40556HIGHA vulnerability has been identified in BACnet ATEC 550-440 (All versions), BACnet ATEC 550-441 (All versions), BACnet ATEC 550-445 (All versEPSS 0.2%CVE-2023-34431HIGHImproper input validation in some Intel(R) Server Board BIOS firmware may allow a privileged user to potentially enable escalation of privilEPSS 0.2%