Weaknesses of type CWE-20

5,357 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2020-12029CRITICALRockwell Automation FactoryTalk View SEEPSS 47.0%CVE-2024-20017CRITICALIn wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no EPSS 46.6%CVE-2019-15276HIGHCisco Wireless LAN Controller HTTP Parsing Engine Denial of Service VulnerabilityEPSS 46.3%CVE-2021-43803HIGHUnexpected server crash in Next.jsEPSS 44.8%CVE-2026-32201MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 43.4%KEVCVE-2023-21818HIGHWindows Secure Channel Denial of Service VulnerabilityEPSS 43.2%CVE-2018-25031MEDIUMSwagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attEPSS 42.3%CVE-2026-12569CRITICALRemote Code Execution (RCE) vulnerability in Windchill PDMlinkEPSS 40.6%KEVCVE-2023-2914HIGHRockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation VulnerabilitiyEPSS 39.9%CVE-2013-6282HIGHThe (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addEPSS 39.7%KEVCVE-2019-1936HIGHCisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Command Injection VulnerabilityEPSS 39.5%CVE-2020-3240CRITICALMultiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big DataEPSS 38.7%CVE-2024-2756MEDIUM__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fixEPSS 38.1%CVE-2022-28127HIGHA data removal vulnerability exists in the web_server /action/remove/ API functionality of Robustel R1510 3.3.0. A specially-crafted networkEPSS 37.9%CVE-2023-26067HIGHCertain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4).EPSS 37.8%CVE-2017-12285—A vulnerability in the web interface of Cisco Network Analysis Module Software could allow an unauthenticated, remote attacker to delete arbEPSS 37.2%CVE-2024-39573HIGHApache HTTP Server: mod_rewrite proxy handler substitutionEPSS 37.2%CVE-2023-22496HIGHNetdata vulnerable to command injection EPSS 36.2%CVE-2024-22476CRITICALImproper input validation in some Intel(R) Neural Compressor software before version 2.5.0 may allow an unauthenticated user to potentially EPSS 36.0%CVE-2025-1097HIGHingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotationEPSS 35.5%