Weaknesses of type CWE-20

5,418 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2024-3028HIGHImproper Input Validation in mintplex-labs/anything-llmEPSS 0.8%CVE-2020-15192MEDIUMMemory leak in TensorflowEPSS 0.8%CVE-2023-40053MEDIUMHTML injection Vulnerability in Serv-U 15.4EPSS 0.8%CVE-2024-25583HIGHCrafted responses can lead to a denial of service in Recursor if recursive forwarding is configuredEPSS 0.8%CVE-2021-26613HIGHtobesoft nexacro arbitrary file creation vulnerabilityEPSS 0.8%CVE-2022-35773HIGHAzure RTOS GUIX Studio Remote Code Execution VulnerabilityEPSS 0.8%CVE-2024-42458CRITICALserver.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security type, a related issue to CVE-2006-2369.EPSS 0.8%CVE-2026-14637HIGHkirilkirkov Ecommerce-CodeIgniter-Bootstrap ShoppingCart.php getCartItems deserializationEPSS 0.8%CVE-2025-55444CRITICALA SQL injection vulnerability exists in the id2 parameter of the cancel_booking.php page in Online Artwork and Fine Arts MCA Project 1.0. A EPSS 0.8%CVE-2023-45161CRITICAL1E-Exchange-URLResponseTime instruction before v20.1 allows arbitrary code executionEPSS 0.8%CVE-2017-15093—When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.EPSS 0.8%CVE-2025-64990MEDIUMCommand Injection in 1E-Explorer-TachyonCore-LogoffUser InstructionEPSS 0.8%CVE-2021-43850MEDIUMDenial of Service in discourseEPSS 0.8%CVE-2023-5964CRITICAL1E-Exchange-DisplayMessage instruction allows for arbitrary code executionEPSS 0.8%CVE-2023-25530HIGHNVIDIA DGX H100 BMC contains a vulnerability in the KVM service, where an attacker may cause improper input validation. A successful exploitEPSS 0.8%CVE-2024-5138HIGHThe snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of EPSS 0.8%CVE-2026-73547HIGHEnvoy ext_authz: request `:path` pseudoheader dereferenced w/o null checkEPSS 0.8%CVE-2026-46454CRITICALApache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headersEPSS 0.8%CVE-2026-71217HIGHIperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustionEPSS 0.8%CVE-2024-33700HIGHThe LevelOne WBR-6012 router firmware R0.40e6 suffers from an input validation vulnerability within its FTP functionality, enabling attackerEPSS 0.8%