Weaknesses of type CWE-20

5,416 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2020-15186LOWImproper sanitization of plugin names in HelmEPSS 1.0%CVE-2021-23051—On BIG-IP versions 15.1.0.4 through 15.1.3, when the Data Plane Development Kit (DPDK)/Elastic Network Adapter (ENA) driver is used with BIGEPSS 1.0%CVE-2021-23048—On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.xEPSS 1.0%CVE-2022-40265HIGHDenial of Service (DoS) Vulnerability in MELSEC iQ-R Series Ethernet Interface ModuleEPSS 1.0%CVE-2021-23030—On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1EPSS 1.0%CVE-2026-65811HIGHPower BI Remote Code Execution VulnerabilityEPSS 1.0%CVE-2022-47502—Apache OpenOffice: Macro URL arbitrary script executionEPSS 1.0%CVE-2026-40411CRITICALAzure Virtual Network Gateway Remote Code Execution VulnerabilityEPSS 1.0%CVE-2026-54120CRITICALMicrosoft Surface Remote Code Execution VulnerabilityEPSS 1.0%CVE-2025-43401HIGHA denial-of-service issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS TaEPSS 1.0%CVE-2020-15206CRITICALDenial of Service in TensorflowEPSS 1.0%CVE-2026-63520HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 1.0%CVE-2020-12526MEDIUMBECKHOFF: DoS-Vulnerability for TwinCAT OPC UA Server and IPC Diagnostics UA ServerEPSS 1.0%CVE-2020-3506HIGHCisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Remote Code Execution and Denial of Service VulnerabilitiesEPSS 1.0%CVE-2025-27151MEDIUMredis-check-aof may lead to stack overflow and potential RCEEPSS 1.0%CVE-2026-72867CRITICALDokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts)EPSS 1.0%CVE-2024-52279HIGHApache Zeppelin: Arbitrary file read by adding malicious JDBC connection stringEPSS 1.0%CVE-2020-7832HIGHRAONWIZ DEXT5 Upload remote code execution vulnerabilityEPSS 1.0%CVE-2020-7865HIGHInoguard ExECM CoreB2B solution remote code execution vulnerabilityEPSS 1.0%CVE-2021-21968HIGHA file write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafteEPSS 1.0%