Weaknesses of type CWE-20

5,384 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2025-1098HIGHingress-nginx controller - configuration injection via unsanitized mirror annotationsEPSS 83.5%CVE-2023-2915HIGHRockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation VulnerabilityEPSS 81.8%CVE-2025-34300CRITICALSawtooth Software Lighthouse Studio < 9.16.14 Pre-Authentication RCEEPSS 79.2%CVE-2026-21858CRITICALn8n Vulnerable to Unauthenticated File Access via Improper Webhook Request HandlingEPSS 78.4%CVE-2024-47076HIGHlibcupsfilters's cfGetPrinterAttributes5 does not validate IPP attributes returned from an IPP serverEPSS 77.6%CVE-2023-36899HIGHASP.NET Elevation of Privilege VulnerabilityEPSS 76.7%CVE-2024-22120CRITICALTime Based SQL Injection in Zabbix Server Audit LogEPSS 76.6%CVE-2020-3247CRITICALMultiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big DataEPSS 75.6%CVE-2020-3248CRITICALMultiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big DataEPSS 74.4%CVE-2018-8414HIGHA remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code ExEPSS 74.0%KEVCVE-2020-3239CRITICALMultiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big DataEPSS 73.6%CVE-2023-2917CRITICALRockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation VulnerabilityEPSS 72.2%CVE-2012-1535HIGHUnspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote aEPSS 70.4%KEVCVE-2020-13942—Remote Code Execution in Apache UnomiEPSS 68.4%CVE-2023-24950MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 67.5%CVE-2018-16873HIGHIn Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag andEPSS 66.3%CVE-2019-12630MEDIUMCisco Security Manager Java Deserialization VulnerabilityEPSS 65.8%CVE-2024-0507MEDIUMPrivilege Escalation by Code Injection in the Management Console in GitHub Enterprise ServerEPSS 65.8%CVE-2022-0415CRITICALRemote Command Execution in uploading repository file in gogs/gogsEPSS 65.2%CVE-2023-1183MEDIUMArbitrary file writeEPSS 64.6%