Weaknesses of type CWE-20

5,399 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2022-26889HIGHPath Traversal in search parameter results in external content injectionEPSS 1.5%CVE-2025-43559CRITICALColdFusion | Improper Input Validation (CWE-20)EPSS 1.5%CVE-2025-53809MEDIUMWindows Local Security Authority Subsystem Service (LSASS) Denial of Service VulnerabilityEPSS 1.5%CVE-2023-29246HIGHApache OpenMeetings: allows null-byte InjectionEPSS 1.5%CVE-2022-43545CRITICALA vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER MEPSS 1.5%CVE-2023-50262MEDIUMDompdf possible DoS caused by infinite recursion when parsing SVG imagesEPSS 1.5%CVE-2022-24093CRITICALAdobe Commerce post-auth improper input validation leads to remote code executionEPSS 1.5%CVE-2019-1951MEDIUMCisco SD-WAN Solution Packet Filtering Bypass VulnerabilityEPSS 1.5%CVE-2023-35303HIGHUSB Audio Class System Driver Remote Code Execution VulnerabilityEPSS 1.5%CVE-2022-24774HIGHImproper Input Validation leading to Path Traversal in CycloneDX BOM Repository ServerEPSS 1.5%CVE-2023-49291CRITICALImproper Sanitization of Branch Name Leads to Arbitrary Code InjectionEPSS 1.4%CVE-2025-30471HIGHA validation issue was addressed with improved logic. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, maEPSS 1.4%CVE-2025-34105CRITICALDiskBoss Enterprise Stack-Based Buffer Overflow RCEEPSS 1.4%CVE-2022-24280MEDIUMApache Pulsar Proxy target broker address isn't validatedEPSS 1.4%CVE-2021-1263HIGHCisco SD-WAN Command Injection VulnerabilitiesEPSS 1.4%CVE-2016-8647LOWAn input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in EPSS 1.4%CVE-2024-34108CRITICALLarge attack surface through legit webhook usage in Adobe CommerceEPSS 1.4%CVE-2021-37206—A vulnerability has been identified in SIPROTEC 5 relays with CPU variants CP050 (All versions < V8.80), SIPROTEC 5 relays with CPU variantsEPSS 1.4%CVE-2023-49299HIGHApache DolphinScheduler: Arbitrary js execute as root for authenticated usersEPSS 1.4%CVE-2018-15424—Multiple Vulnerabilities in Cisco Identity Services EngineEPSS 1.4%