Weaknesses of type CWE-20

5,393 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2025-29814CRITICALMicrosoft Partner Center Elevation of Privilege VulnerabilityEPSS 2.2%CVE-2023-35377MEDIUMMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 2.2%CVE-2023-35376MEDIUMMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 2.2%CVE-2023-32057CRITICALMicrosoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityEPSS 2.2%CVE-2020-25721—Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now provides a way for Linux applications to EPSS 2.2%CVE-2017-12264—A vulnerability in the Web Admin Interface of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a denial of servEPSS 2.2%CVE-2025-34111CRITICALTiki Wiki <= 15.1 ELFinder Unauthenticated File Upload RCEEPSS 2.2%CVE-2025-24970HIGHSslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngineEPSS 2.2%CVE-2023-36893MEDIUMMicrosoft Outlook Spoofing VulnerabilityEPSS 2.2%CVE-2022-47937CRITICALMultiple parsing problems in the Apache Sling Commons JSON moduleEPSS 2.2%CVE-2019-1740HIGHCisco IOS and IOS XE Software Network-Based Application Recognition Denial of Service VulnerabilitiesEPSS 2.2%CVE-2019-1743HIGHCisco IOS XE Software Arbitrary File Upload VulnerabilityEPSS 2.2%CVE-2023-2728MEDIUMBypassing enforce mountable secrets policy imposed by the ServiceAccount admission pluginEPSS 2.2%CVE-2023-28710HIGHApache Airflow Spark Provider Arbitrary File Read via JDBCEPSS 2.2%CVE-2020-7588—A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2EPSS 2.2%CVE-2021-3754—A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. ThisEPSS 2.1%CVE-2020-6651HIGHCommand injection via specially crafted file name during config file uploadEPSS 2.1%CVE-2025-21350MEDIUMWindows Kerberos Denial of Service VulnerabilityEPSS 2.1%CVE-2023-40272HIGHApache Airflow Spark Provider Arbitrary File Read via JDBCEPSS 2.1%CVE-2020-25713—A malformed input file can lead to a segfault due to an out of bounds array access in raptor_xml_writer_start_element_common.EPSS 2.1%