Weaknesses of type CWE-20

5,455 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2024-42410MEDIUMImproper input validation in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable denial of service via locaEPSS 0.2%CVE-2025-8075MEDIUMImproper Input ValidationEPSS 0.2%CVE-2026-11078MEDIUMInappropriate implementation in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rendereEPSS 0.2%CVE-2024-23487HIGHImproper input validation in UserAuthenticationSmm driver in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a priviEPSS 0.2%CVE-2026-11283MEDIUMInsufficient validation of untrusted input in Shortcuts in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to bypass nEPSS 0.2%CVE-2026-87568MEDIUMImproper input validation in Chromium in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proEPSS 0.2%CVE-2022-38102HIGHImproper Input validation in firmware for some Intel(R) Converged Security and Management Engine before versions 15.0.45, and 16.1.27 may alEPSS 0.2%CVE-2023-41782LOWDLL Hijacking Vulnerability in ZTE ZXCLOUD iRAIEPSS 0.2%CVE-2026-22567HIGHZIA Admin UI Input Validation BugEPSS 0.2%CVE-2026-52876HIGHStreambert: Arbitrary File Execution via VLC/mpv Launcher FallbackEPSS 0.2%CVE-2026-11218MEDIUMInappropriate implementation in PlatformIntegration in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who convincEPSS 0.2%CVE-2026-9903MEDIUMInsufficient validation of untrusted input in Site Isolation in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compEPSS 0.2%CVE-2022-34460HIGH Prior Dell BIOS versions contain an improper input validation vulnerability. A local authenticated malicious user may potentially exploit tEPSS 0.2%CVE-2023-43799MEDIUMThe Altair Desktop Client Does Not Sanitize External URLs before passing them to the underlying systemEPSS 0.2%CVE-2026-21678HIGHiccDEV has heap-buffer-overflow vulnerability on IccTagXml()EPSS 0.2%CVE-2026-0903MEDIUMInappropriate implementation in Downloads in Google Chrome on Windows prior to 144.0.7559.59 allowed a remote attacker to bypass dangerous fEPSS 0.2%CVE-2026-21505MEDIUMiccDEV has Undefined Behavior (UB) - Invalid Enum ValueEPSS 0.2%CVE-2025-54368MEDIUMuv is vulnerable to ZIP payload obfuscation through parsing differentialsEPSS 0.2%CVE-2026-91819MEDIUMMISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponentEPSS 0.2%CVE-2022-26006HIGHImproper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of EPSS 0.2%