Weaknesses of type CWE-20

5,455 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2025-11497MEDIUMAdvanced Database Cleaner <= 3.1.6 - Cross-Site Request Forgery to Settings ManipulationEPSS 0.2%CVE-2026-7931MEDIUMInsufficient validation of untrusted input in iOS in Google Chrome on iOS prior to 148.0.7778.96 allowed a remote attacker to perform UI spoEPSS 0.2%CVE-2022-36873MEDIUMImproper restriction of broadcasting Intent in GalaxyStoreBridgePageLinker of?Waterplugin prior to version 2.2.11.22081151 leaks MAC addressEPSS 0.2%CVE-2026-10863MEDIUMMISP User-controlled order parameter in correlations over-correlation endpointEPSS 0.2%CVE-2025-32069MEDIUMWikitext stored XSS on filepages due to dangerous WBMI serializationEPSS 0.2%CVE-2025-43348MEDIUMA logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. AnEPSS 0.2%CVE-2025-32073MEDIUMSystem message XSS in HTMLTagsEPSS 0.2%CVE-2025-6376HIGHArena® Simulation Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.2%CVE-2025-32070MEDIUMXSSes in AJAXPollEPSS 0.2%CVE-2026-79259MEDIUMImproper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictEPSS 0.2%CVE-2026-13024MEDIUMInsufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromiEPSS 0.2%CVE-2026-59298LOWPotential for improper filtering of HTTP headers in Spring Cloud FunctionEPSS 0.2%CVE-2026-11653MEDIUMInappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderEPSS 0.2%CVE-2026-11023MEDIUMInappropriate implementation in WebAppInstalls in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renEPSS 0.2%CVE-2025-32067MEDIUMi18n XSS vulnerability in message growthexperimentsEPSS 0.2%CVE-2025-6377HIGHArena® Simulation Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.2%CVE-2024-37365HIGHFactoryTalk View ME Remote Code Execution Vulnerability via Project Save PathEPSS 0.2%CVE-2021-26736MEDIUMZApp Installer Privilege Escalation VulnerabilitiesEPSS 0.2%CVE-2026-11658MEDIUMInsufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromiEPSS 0.2%CVE-2025-32071MEDIUMWikibase CommonsInlineImageFormatter: i18n XSSEPSS 0.2%