Weaknesses of type CWE-233

31 results

Manipulação inadequada de parâmetros

Ocorre quando a aplicação não valida, sanitiza ou processa corretamente os parâmetros recebidos de usuários ou sistemas externos. O código assume que os dados estão no formato esperado sem verificar tipo, tamanho, conteúdo ou range, permitindo comportamentos inesperados ou exploráveis.

Example

Uma API que recebe um ID de usuário como parâmetro e o usa direto em uma query SQL sem validação: um atacante passa uma string malformada, null, número negativo ou comando SQL que não era esperado, causando erro, injeção ou acesso a dados não autorizado.

How to mitigate

Sempre validar entrada: verificar tipo de dado, intervalo numérico, comprimento de string e caracteres permitidos. Use listas brancas, não listas negras. Sanitize antes de usar em operações sensíveis (SQL, comandos de sistema, desserialização) e implemente tratamento de erro robusto para parâmetros inválidos.

CVE-2025-52970HIGHA improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.EPSS 9.8%CVE-2023-20076HIGHCisco IOx Application Hosting Environment Command Injection VulnerabilityEPSS 1.5%CVE-2021-1230HIGHCisco Nexus 9000 Series Fabric Switches ACI Mode BGP Route Installation Denial of Service VulnerabilityEPSS 1.5%CVE-2024-24525CRITICALAn issue in EpointWebBuilder 5.1.0-sp1, 5.2.1-sp1, 5.4.1 and 5.4.2 allows a remote attacker to execute arbitrary code via the infoid parametEPSS 1.1%CVE-2024-31808HIGHTOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the webWlanIdx parameter in EPSS 0.9%CVE-2022-45182CRITICALPi-Star_DV_Dash (for Pi-Star DV) before 5aa194d mishandles the module parameter.EPSS 0.9%CVE-2021-0269HIGHJunos OS: J-Web can be compromised through reflected client-side HTTP parameter pollution attacks.EPSS 0.9%CVE-2022-3697—A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. ThEPSS 0.7%CVE-2024-9329MEDIUMGlassfish redirect to untrusted siteEPSS 0.7%CVE-2022-32261MEDIUMA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a misconfiguratEPSS 0.7%CVE-2024-33433MEDIUMCross Site Scripting vulnerability in TOTOLINK X2000R before v1.0.0-B20231213.1013 allows a remote attacker to execute arbitrary code via thEPSS 0.6%CVE-2022-22792MEDIUMMobiSoft - MobiPlus User Take Over and Improper Handling of url ParametersEPSS 0.6%CVE-2021-45477MEDIUMIDOR in Yordam Library Automation SystemEPSS 0.6%CVE-2021-45478MEDIUMIDOR in Yordam Library Automation SystemEPSS 0.6%CVE-2024-25979MEDIUMMsa-24-0002: forum search accepted random parameters in its urlEPSS 0.6%CVE-2026-2370HIGHImproper Handling of Parameters in GitLabEPSS 0.4%CVE-2023-26549—The SystemUI module has a vulnerability of repeated app restart due to improper parameters. Successful exploitation of this vulnerability maEPSS 0.4%CVE-2026-32998CRITICALThis vulnerability in Veeam Service Provider Console allows for remote code execution.EPSS 0.4%CVE-2020-10069MEDIUMZephyr Bluetooth unchecked packet data results in denial of serviceEPSS 0.4%CVE-2023-1419MEDIUMDebezium: script injection via connector parameterEPSS 0.4%