Weaknesses of type CWE-20

5,399 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2021-40127MEDIUMCisco Small Business 200, 300, and 500 Series Switches Web-Based Management Interface Denial of Service VulnerabilityEPSS 1.3%CVE-2020-3164MEDIUMCisco ESA, Cisco WSA, and Cisco SMA GUI Denial of Service VulnerabilityEPSS 1.3%CVE-2024-32007HIGHApache CXF Denial of Service vulnerability in JOSEEPSS 1.3%CVE-2024-38194HIGHAzure Web Apps Elevation of Privilege VulnerabilityEPSS 1.3%CVE-2019-10937—A vulnerability has been identified in SIMATIC TDC CP51M1 (All versions < V1.1.7). An attacker with network access to the device could causeEPSS 1.3%CVE-2022-21646HIGHLookup operations do not take into account wildcards in SpiceDBEPSS 1.3%CVE-2022-25271—Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validationEPSS 1.3%CVE-2025-30391HIGHMicrosoft Dynamics Information Disclosure VulnerabilityEPSS 1.3%CVE-2021-34736MEDIUMCisco Integrated Management Controller GUI Denial of Service VulnerabilityEPSS 1.3%CVE-2023-20009MEDIUMA vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) coEPSS 1.3%CVE-2022-39353CRITICALxmldom allows multiple root nodes in a DOMEPSS 1.3%CVE-2026-50633HIGHApache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImplEPSS 1.3%CVE-2021-26617HIGHGabia Firstmall remote code execution vulnerabilityEPSS 1.3%CVE-2018-19952—If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. This issue affects: QNAP SystEPSS 1.3%CVE-2026-75638MEDIUMCAI Content Credentials | Improper Input Validation (CWE-20)EPSS 1.3%CVE-2024-5171CRITICALheap buffer overflow in libaomEPSS 1.3%CVE-2018-3776—Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being logged in the audit loEPSS 1.3%CVE-2023-35798—Airflow Apache ODBC and MSSQL Providers Arbitrary File Read VulnerabilityEPSS 1.3%CVE-2022-36058HIGHelrond-go MultiESDTNFTTransfer call on a SC address with missing function nameEPSS 1.3%CVE-2023-46116CRITICALRemote Code Execution via insufficiently sanitized call to shell.openExternalEPSS 1.3%