Weaknesses of type CWE-20

5,888 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2024-3028HIGHImproper Input Validation in mintplex-labs/anything-llmEPSS 0.8%CVE-2020-15192MEDIUMMemory leak in TensorflowEPSS 0.8%CVE-2026-47370CRITICALA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain deEPSS 0.8%CVE-2026-76980HIGHData Exposure vulnerabilityEPSS 0.8%CVE-2023-40053MEDIUMHTML injection Vulnerability in Serv-U 15.4EPSS 0.8%CVE-2021-26613HIGHtobesoft nexacro arbitrary file creation vulnerabilityEPSS 0.8%CVE-2024-42458CRITICALserver.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security type, a related issue to CVE-2006-2369.EPSS 0.8%CVE-2026-14637HIGHkirilkirkov Ecommerce-CodeIgniter-Bootstrap ShoppingCart.php getCartItems deserializationEPSS 0.8%CVE-2022-35773HIGHAzure RTOS GUIX Studio Remote Code Execution VulnerabilityEPSS 0.8%CVE-2017-15093—When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.EPSS 0.8%CVE-2023-25530HIGHNVIDIA DGX H100 BMC contains a vulnerability in the KVM service, where an attacker may cause improper input validation. A successful exploitEPSS 0.8%CVE-2025-2296HIGHUn-verified kernel bypass Secure Boot mechanism in direct boot modeEPSS 0.8%CVE-2026-46454CRITICALApache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headersEPSS 0.8%CVE-2025-4563LOWNodes can bypass dynamic resource allocation authorization checksEPSS 0.8%CVE-2024-25583HIGHCrafted responses can lead to a denial of service in Recursor if recursive forwarding is configuredEPSS 0.8%CVE-2026-47367CRITICALA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UID EnterpEPSS 0.8%CVE-2024-33700HIGHThe LevelOne WBR-6012 router firmware R0.40e6 suffers from an input validation vulnerability within its FTP functionality, enabling attackerEPSS 0.8%CVE-2014-125114HIGHi-Ftp 2.20 Schedule.xml Stack-Based Buffer OverflowEPSS 0.8%CVE-2024-38479HIGHApache Traffic Server: Cache key plugin is vulnerable to cache poisoning attackEPSS 0.8%CVE-2021-25255HIGHYandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service.EPSS 0.8%