Weaknesses of type CWE-20

5,386 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2021-29425—Possible limited path traversal vulnerabily in Apache Commons IOEPSS 10.2%CVE-2020-5260CRITICALmalicious URLs may cause Git to present stored credentials to the wrong serverEPSS 10.0%CVE-2022-23626HIGHInsufficient file checks in m1k1o/blogEPSS 9.9%CVE-2025-34102CRITICALCryptoLog Unauthenticated RCE via SQL Injection and Command InjectionEPSS 9.6%CVE-2023-29464HIGHRockwell Automation FactoryTalk Linx Vulnerable to Denial-of-Service and Information DisclosureEPSS 9.6%CVE-2025-6558HIGHInsufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentiallEPSS 9.6%KEVCVE-2024-30087HIGHWin32k Elevation of Privilege VulnerabilityEPSS 9.5%CVE-2026-40871HIGHmailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via APIEPSS 9.3%CVE-2021-43779CRITICALRemote Command Execution vulnerabilityEPSS 9.1%CVE-2015-2291HIGH(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cEPSS 9.0%KEVCVE-2022-0073HIGHAuthenticated Remote Code Execution in OpenLiteSpeed Web ServerEPSS 8.8%CVE-2015-9235—In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetEPSS 8.7%CVE-2018-0304—A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remotEPSS 8.6%CVE-2024-38189HIGHMicrosoft Project Remote Code Execution VulnerabilityEPSS 8.2%KEVCVE-2025-52905HIGHTOTOLINK X6000R Argument Injection VulnerabilityEPSS 8.1%CVE-2023-34152CRITICALA vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes conEPSS 8.0%CVE-2021-25741HIGHSymlink Exchange Can Allow Host Filesystem AccessEPSS 8.0%CVE-2020-29075HIGHPDF Injection BlackHat TalkEPSS 7.9%CVE-2023-36731HIGHWin32k Elevation of Privilege VulnerabilityEPSS 7.8%CVE-2018-0172HIGHA vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticEPSS 7.8%KEV