Weaknesses of type CWE-20

5,887 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2023-32695HIGHInsufficient validation when decoding a Socket.IO packetEPSS 1.1%CVE-2021-22288HIGHSECURITY – Denial of Service Vulnerabilities in SPIET800 INFI-Net to Ethernet Transfer module and PNI800 S+ Ethernet communication interface moduleEPSS 1.1%CVE-2013-4144—There is an object injection vulnerability in swfupload plugin for wordpress.EPSS 1.1%CVE-2021-22286HIGHSECURITY – Denial of Service Vulnerabilities in SPIET800 INFI-Net to Ethernet Transfer module and PNI800 S+ Ethernet communication interface moduleEPSS 1.1%CVE-2025-27151MEDIUMredis-check-aof may lead to stack overflow and potential RCEEPSS 1.1%CVE-2023-42802CRITICALGLPI vulnerable to unallowed PHP script executionEPSS 1.1%CVE-2024-38033HIGHPowerShell Elevation of Privilege VulnerabilityEPSS 1.1%CVE-2021-26631HIGHMangboard parameter modulation vulnerabilityEPSS 1.1%CVE-2023-38727MEDIUMIBM Db2 denial of serviceEPSS 1.1%CVE-2023-29258MEDIUMIBM Db2 denial of serviceEPSS 1.1%CVE-2023-40687MEDIUMIBM Db2 denial of serviceEPSS 1.1%CVE-2021-23278HIGHArbitrary File deleteEPSS 1.1%CVE-2024-20003HIGHIn Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of service, if NW sent EPSS 1.1%CVE-2025-43234CRITICALMultiple memory corruption issues were addressed with improved input validation. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS SequEPSS 1.1%CVE-2019-10134MEDIUMA flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The size of users' private file uploads via email were not correctly EPSS 1.1%CVE-2021-26605HIGHunidocs ezPDFReader arbitrary command execution vulnerabilityEPSS 1.0%CVE-2024-36053CRITICALIn the mintupload package through 4.2.0 for Linux Mint, service-name mishandling leads to command injection via shell metacharacters in checEPSS 1.0%CVE-2022-39318MEDIUMDivision by zero in urbdrc channel in FreeRDPEPSS 1.0%CVE-2026-40176HIGHComposer is vulnerable to Command Injection via Malicious Perforce RepositoryEPSS 1.0%CVE-2023-51747HIGHSMTP smuggling in Apache JamesEPSS 1.0%