Weaknesses of type CWE-20

5,847 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2025-30391HIGHMicrosoft Dynamics Information Disclosure VulnerabilityEPSS 1.4%CVE-2022-1727HIGHImproper Input Validation in jgraph/drawioEPSS 1.4%CVE-2024-25995CRITICALPHOENIX CONTACT: Remote code execution in CHARX SeriesEPSS 1.4%CVE-2023-22888—Apache Airflow: Scheduler remote DoSEPSS 1.4%CVE-2023-40515HIGHLG Simple Editor joinAddUser Improper Input Validation Denial-of-Service VulnerabilityEPSS 1.4%CVE-2024-9042MEDIUMThis CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listeEPSS 1.4%CVE-2026-57499CRITICALLiman: OS Command Injection in LogRotationController allows authenticated admin to execute arbitrary commands (RCE)EPSS 1.4%CVE-2026-24893HIGHopenITCOCKPIT has Authenticated Command Injection Leading to Remote Code Execution via Host Address Macro ExpansionEPSS 1.4%CVE-2018-16561HIGHA vulnerability has been identified in SIMATIC S7-300 CPUs (All versions < V3.X.16). The affected CPUs improperly validate S7 communication EPSS 1.4%CVE-2024-41112CRITICALRemote code execution in streamlit geospatial in pages/1_📷_Timelapse.py Any Earth Engine ImageCollection option paletteEPSS 1.4%CVE-2024-41113CRITICALRemote code execution in streamlit geospatial in pages/1_📷_Timelapse.py Any Earth Engine ImageCollection option vis_paramsEPSS 1.4%CVE-2024-41114CRITICALRemote code execution in streamlit geospatial in pages/1_📷_Timelapse.py MODIS Gap filled Land Surface Temperature Daily optionEPSS 1.4%CVE-2024-41119CRITICALstreamlit-geospatial remote code execution in pages/8_🏜️_Raster_Data_Visualization.pyEPSS 1.4%CVE-2025-59228HIGHMicrosoft SharePoint Remote Code Execution VulnerabilityEPSS 1.4%CVE-2020-27844—A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to opeEPSS 1.4%CVE-2023-22272HIGHZDI-CAN-21309: Adobe RoboHelp Server resolveDistinguishedName LDAP Injection Information Disclosure VulnerabilityEPSS 1.4%CVE-2019-16026MEDIUMCisco Mobility Management Entity Denial of Service VulnerabilityEPSS 1.4%CVE-2020-27828—There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitraryEPSS 1.4%CVE-2024-23320HIGHApache DolphinScheduler: Arbitrary js execution as root for authenticated usersEPSS 1.4%CVE-2018-10843HIGHsource-to-image component of Openshift Container Platform before versions atomic-openshift 3.7.53, atomic-openshift 3.9.31 is vulnerable to EPSS 1.4%