Weaknesses of type CWE-348

104 results

Uso de fonte menos confiável

A aplicação confia em dados ou instruções de uma fonte com menor nível de confiança (como entrada de usuário, rede não autenticada ou sistema terceiro) quando deveria usar uma fonte mais segura (como configuração local validada ou sistema interno autenticado). Isso permite que um atacante contamine decisões críticas do programa.

Example

Um sistema de pagamento que valida o valor da transação consultando um parâmetro enviado pelo cliente HTTP, em vez de recuperar o preço armazenado no banco de dados do servidor. Um atacante pode modificar o parâmetro e pagar menos do que deveria.

How to mitigate

Nunca confie em dados do cliente para decisões de segurança ou negócio críticas. Sempre valide e recupere informações sensíveis a partir de fontes internas (banco de dados, configuração do servidor) e use autenticação/autorização para qualquer dado externo que precise processar.

CVE-2026-90679MEDIUMForgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not EPSS 0.2%CVE-2025-53522MEDIUMMovable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unaEPSS 0.2%CVE-2025-1245MEDIUMBypass Connection Restriction Vulnerability in Hitachi Ops Center AnalyzerEPSS 0.2%CVE-2026-87070MEDIUMForminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP SpoofingEPSS 0.2%CVE-2025-47149MEDIUMThe optional feature 'Anti-Virus & Sandbox' of i-FILTER contains an issue with improper pattern file validation. If exploited, the product mEPSS 0.2%CVE-2026-63220MEDIUMCodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()EPSS 0.2%CVE-2026-102275MEDIUMPyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusionEPSS 0.2%CVE-2026-107567HIGHUse of Less Trusted Source in hMailServerEPSS 0.2%CVE-2026-107271MEDIUMGophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For SpoofingEPSS 0.2%CVE-2026-114474MEDIUMUse of Less Trusted Source in hMailServerEPSS 0.2%CVE-2026-22201MEDIUMwpDiscuz before 7.6.47 - IP Address Spoofing in getIP()EPSS 0.2%CVE-2026-3635MEDIUMFastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust functionEPSS 0.2%CVE-2026-111443MEDIUMWheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in productionEPSS 0.2%CVE-2024-54840MEDIUMPVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address environment issues EPSS 0.2%CVE-2026-80514MEDIUMwpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit BypassEPSS 0.2%CVE-2026-59999MEDIUMIn sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.EPSS 0.2%CVE-2025-47424HIGHRetool (self-hosted) before 3.196.0 allows Host header injection. When the BASE_DOMAIN environment variable is not set, the HTTP host headerEPSS 0.2%CVE-2026-16732MEDIUMfastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-countEPSS 0.2%CVE-2025-69240HIGHHeader Poisoning in Raytha CMSEPSS 0.2%CVE-2026-46466LOWDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1EPSS 0.2%