Fallos del tipo CWE-184
197 resultadosLista incompleta de entradas bloqueadas
Ocorre quando o desenvolvedor cria uma lista de padrões ou caracteres proibidos, mas deixa de fora alguns que também deveriam estar ali. Atacantes exploram as entradas não bloqueadas para contornar a validação e injetar código malicioso ou dados malformados.
Ejemplo
Um formulário bloqueia caracteres como '<' e '>' para prevenir XSS, mas esquece de bloquear aspas duplas e eventos JavaScript embutidos. Um atacante injeta onclick="alert('pwned')" e a validação deixa passar.
Cómo mitigar
Use abordagem whitelist (aceitar só o que é válido) em vez de blacklist (bloquear o que é ruim). Se precisar de blacklist, revise frequentemente a lista e teste contra vetores conhecidos. Melhor ainda: sanitize a entrada conforme o contexto onde será usada (HTML, SQL, URL, etc).
CVE-2026-77124HIGHNexus Repository 3 - Script Execution Disable Setting Not EnforcedEPSS 0.3%CVE-2026-34425MEDIUMOpenClaw - Shell-Bleed Protection Preflight Validation BypassEPSS 0.3%CVE-2026-32940CRITICALSiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)EPSS 0.3%CVE-2026-54070HIGHSiYuan: Stored XSS in Bazaar marketplace via package README event handlersEPSS 0.3%CVE-2026-32128MEDIUMFastGPT Python Sandbox Bypass of File-Write RestrictionEPSS 0.3%CVE-2026-62676HIGHOmnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.pyEPSS 0.3%CVE-2026-70466MEDIUMA incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 alEPSS 0.3%CVE-2026-4509MEDIUMPbootCMS File Upload file.php incomplete blacklistEPSS 0.3%CVE-2026-31993MEDIUMOpenClaw < 2026.2.22 - Allowlist Parsing Mismatch in system.run Shell ChainsEPSS 0.3%CVE-2026-42590HIGHGotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklistEPSS 0.3%CVE-2026-43578CRITICALOpenClaw 2026.3.31 < 2026.4.10 - Privilege Escalation via Missed Async Exec Completion Events in Heartbeat Owner DowngradeEPSS 0.3%CVE-2026-90808MEDIUMHKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklistEPSS 0.3%CVE-2026-39315MEDIUMUnhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()EPSS 0.3%CVE-2025-58361CRITICALPromptcraft Forge Studio's incomplete URL check is vulnerable to XSS via SVGEPSS 0.3%CVE-2026-35000HIGHChangeDetection.io < 0.54.7 SafeXPath3Parser Bypass Arbitrary File ReadEPSS 0.3%CVE-2025-24388LOWUnsafe handling of AJAX callsEPSS 0.3%CVE-2025-67747HIGHFickling has missing detection for marshal.loads and types.FunctionType in unsafe modules listEPSS 0.3%CVE-2026-59261HIGHOpenClaw < 2026.5.28 - Credential Override via Workspace Dotenv FilesEPSS 0.3%CVE-2026-11918MEDIUMIBM ContextForge MCP Gateway is affected by security filter bypass via nested payload structuresEPSS 0.3%CVE-2025-67748HIGHFickling has Code Injection vulnerability via pty.spawn()EPSS 0.3%