Weaknesses of type CWE-20

5,888 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2023-5397HIGHServer receiving a malformed message to create a new connection could lead to an attacker performing remote code execution or causing a failEPSS 0.8%CVE-2022-23831HIGHInsufficient validation of the IOCTL input buffer in AMD μProf may allow an attacker to send an arbitrary buffer leading to a potential WindEPSS 0.8%CVE-2019-19164HIGHDext5 Upload ActiveX Arbitrary File Execution VulnerabilityEPSS 0.8%CVE-2024-29946HIGHRisky command safeguards bypass in Dashboard Examples HubEPSS 0.8%CVE-2021-42122MEDIUMDenial of Service via Invalid Object Attribute in TopEaseEPSS 0.8%CVE-2021-33141HIGHImproper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an unautEPSS 0.8%CVE-2023-5104MEDIUMImproper Input Validation in nocodb/nocodbEPSS 0.8%CVE-2021-38455HIGHAUVESY VersiondogEPSS 0.8%CVE-2023-29353MEDIUMSysinternals Process Monitor for Windows Denial of Service VulnerabilityEPSS 0.8%CVE-2022-22726—A CWE-20: Improper Input Validation vulnerability exists that could allow arbitrary files on the server to be read by authenticated users thEPSS 0.8%CVE-2023-5079HIGHLenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could resulEPSS 0.8%CVE-2023-47355HIGHThe com.eypcnnapps.quickreboot (aka Eyuep Can Yilmaz {ROOT] Quick Reboot) application 1.0.8 for Android has exposed broadcast receivers for EPSS 0.8%CVE-2026-11736LOWStack-based buffer overflow vulnerability in some NETGEAR Nighthawk routersEPSS 0.8%CVE-2024-41976HIGHA vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM EPSS 0.8%CVE-2024-38879HIGHA vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), OmniviEPSS 0.8%CVE-2018-12448—Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar when visiting a non-htEPSS 0.8%CVE-2026-35031CRITICALJellyfin: Potential RCE via subtitle upload path traversal + .strm chainEPSS 0.8%CVE-2026-35433HIGH.NET Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2023-46929HIGHAn issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box in gf_avc_change_vui /afltest/gpac/src/media_tools/av_parsers.c:6872:EPSS 0.8%CVE-2025-26413HIGHApache Kvrocks: The server was crashed by the negative offsetEPSS 0.8%