Weaknesses of type CWE-20

5,418 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2025-21194HIGHMicrosoft Surface Security Feature Bypass VulnerabilityEPSS 0.8%CVE-2025-10155CRITICALPickleScan Security Bypass Using Misleading File ExtensionEPSS 0.8%CVE-2026-42579HIGHNetty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)EPSS 0.8%CVE-2023-0100—In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HTEPSS 0.8%CVE-2024-45117HIGHAdobe Commerce | Improper Input Validation (CWE-20)EPSS 0.8%CVE-2025-52907HIGHTOTOLINK X6000R Security Bypass VulnerabilityEPSS 0.8%CVE-2024-47823HIGHLivewire Remote Code Execution (RCE) on File UploadsEPSS 0.8%CVE-2022-22658MEDIUMAn input validation issue was addressed with improved input validation. This issue is fixed in iOS 16.0.3. Processing a maliciously crafted EPSS 0.8%CVE-2024-21625HIGHOne-click remote code execution via malicious deep linkEPSS 0.8%CVE-2023-22465HIGHHttp4s has fatal error parsing User-Agent and Server headersEPSS 0.8%CVE-2026-33218HIGHNATS has pre-auth server panic via leafnode handlingEPSS 0.8%CVE-2022-40227HIGHA vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions < V17 Update 4), SIMATIC HMI KTP MobEPSS 0.8%CVE-2021-3048MEDIUMPAN-OS: Invalid URLs in an External Dynamic List (EDL) can Lead to Firewall OutageEPSS 0.8%CVE-2025-21344HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 0.8%CVE-2020-15234MEDIUMRedirect URL matching ignores character casingEPSS 0.8%CVE-2017-6794—A vulnerability in the CLI command-parsing code of Cisco Meeting Server could allow an authenticated, local attacker to perform command injeEPSS 0.8%CVE-2023-36762HIGHMicrosoft Word Remote Code Execution VulnerabilityEPSS 0.8%CVE-2023-38495HIGHCrossplane vulnerable to possible image tampering from missing image validation for PackagesEPSS 0.8%CVE-2021-3802—A vulnerability found in udisks2. This flaw allows an attacker to input a specially crafted image file/USB leading to kernel panic. The highEPSS 0.8%CVE-2021-37863LOWMattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a cEPSS 0.8%