Weaknesses of type CWE-20

5,386 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2015-2177HIGHSiemens SIMATIC S7-300 CPU devices allow remote attackers to cause a denial of service (defect-mode transition) via crafted packets on (1) TEPSS 34.7%CVE-2026-6973HIGHAn Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with adminEPSS 34.5%KEVCVE-2022-42340HIGHAdobe ColdFusion Improper Input Validation Arbitrary file system readEPSS 33.8%CVE-2023-24033HIGHThe Samsung Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto T512 baseband modem chipsets do not properly checEPSS 33.2%CVE-2020-8195MEDIUMImproper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 andEPSS 33.0%KEVCVE-2023-4197HIGHDolibarr ERP CRM (<= 18.0.1) Improper Input Sanitization Authenticated RCEEPSS 32.8%CVE-2025-24514HIGHingress-nginx controller - configuration injection via unsanitized auth-url annotationEPSS 32.6%CVE-2024-21388MEDIUMMicrosoft Edge (Chromium-based) Elevation of Privilege VulnerabilityEPSS 32.0%CVE-2025-20393CRITICALCisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution VulnerabilityEPSS 29.9%KEVCVE-2024-4548CRITICALDelta Electronics DIAEnergie SQL InjectionEPSS 29.4%CVE-2024-49368HIGHUnchecked logrotate settings lead to arbitrary command executionEPSS 27.7%CVE-2021-3490HIGHLinux kernel eBPF bitwise ops ALU32 bounds trackingEPSS 27.5%CVE-2021-23279HIGHArbitrary File deleteEPSS 27.1%CVE-2024-7646HIGHA security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `exEPSS 27.0%CVE-2019-11253HIGHKubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attackEPSS 25.9%CVE-2019-1914HIGHCisco Small Business 220 Series Smart Switches Command Injection VulnerabilityEPSS 24.9%CVE-2018-19949CRITICALIf exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue EPSS 24.4%KEVCVE-2022-38900HIGHdecode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.EPSS 23.8%CVE-2020-3249CRITICALMultiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big DataEPSS 23.6%CVE-2024-24549HIGHApache Tomcat: HTTP/2 header handling DoSEPSS 23.1%