Weaknesses of type CWE-20

5,842 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2018-0472—Cisco IOS XE Software and Cisco ASA 5500-X Series Adaptive Security Appliance IPsec Denial of Service VulnerabilityEPSS 16.2%CVE-2015-2291HIGH(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cEPSS 15.7%KEVCVE-2025-49719HIGHMicrosoft SQL Server Information Disclosure VulnerabilityEPSS 15.5%CVE-2023-29464HIGHRockwell Automation FactoryTalk Linx Vulnerable to Denial-of-Service and Information DisclosureEPSS 15.0%CVE-2020-5260CRITICALmalicious URLs may cause Git to present stored credentials to the wrong serverEPSS 14.9%CVE-2019-7193CRITICALThis improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP EPSS 14.4%KEVCVE-2023-23560CRITICALIn certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation.EPSS 13.9%CVE-2017-12240CRITICALThe DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticatEPSS 13.8%KEVCVE-2023-3676HIGHKubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalationEPSS 13.2%CVE-2018-1058—A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account couEPSS 13.1%CVE-2020-3387HIGHCisco SD-WAN vManage Software Remote Code Execution VulnerabilityEPSS 13.0%CVE-2023-28324HIGHA improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege escalation or remote cEPSS 12.9%CVE-2023-21434MEDIUMImproper input validation vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to execute JavaScript by launching EPSS 12.9%CVE-2019-3871MEDIUMA vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from theEPSS 12.6%CVE-2020-12001—FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ContEPSS 11.8%CVE-2023-26068CRITICALCertain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4).EPSS 11.6%CVE-2014-3480MEDIUMThe cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, dEPSS 11.5%CVE-2020-24432MEDIUMAcrobat Reader DC Arbitrary JavaScript Execution in PDF DocumentsEPSS 11.1%CVE-2025-6558HIGHInsufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentiallEPSS 10.9%KEVCVE-2018-1140MEDIUMA missing input sanitization flaw was found in the implementation of LDP database used for the LDAP server. An attacker could use this flaw EPSS 10.9%