Fallos del tipo CWE-184
197 resultadosLista incompleta de entradas bloqueadas
Ocorre quando o desenvolvedor cria uma lista de padrões ou caracteres proibidos, mas deixa de fora alguns que também deveriam estar ali. Atacantes exploram as entradas não bloqueadas para contornar a validação e injetar código malicioso ou dados malformados.
Ejemplo
Um formulário bloqueia caracteres como '<' e '>' para prevenir XSS, mas esquece de bloquear aspas duplas e eventos JavaScript embutidos. Um atacante injeta onclick="alert('pwned')" e a validação deixa passar.
Cómo mitigar
Use abordagem whitelist (aceitar só o que é válido) em vez de blacklist (bloquear o que é ruim). Se precisar de blacklist, revise frequentemente a lista e teste contra vetores conhecidos. Melhor ainda: sanitize a entrada conforme o contexto onde será usada (HTML, SQL, URL, etc).
CVE-2026-72860MEDIUM9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is UnreachableEPSS 0.3%CVE-2025-61924LOWPrestaShop Checkout Target PayPal merchant account hijacking from backofficeEPSS 0.3%CVE-2026-61851MEDIUMChartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery ToolEPSS 0.3%CVE-2026-44993LOWOpenClaw < 2026.4.20 - Direct Message Misclassification in Feishu Card ActionsEPSS 0.3%CVE-2023-45593MEDIUMA CWE-184 “Incomplete List of Disallowed Inputs” vulnerability in the embedded Chromium browser (concerning the handling of alternative URLsEPSS 0.3%CVE-2025-67716MEDIUMAuth0 Next.js SDK has Improper Validation of Query ParametersEPSS 0.3%CVE-2026-34426MEDIUMOpenClaw - Approval Bypass via Environment Variable NormalizationEPSS 0.3%CVE-2026-53855HIGHOpenClaw < 2026.4.2 - Shell Positional Parameters Bypass in Inline-Eval ChecksEPSS 0.3%CVE-2026-32022MEDIUMOpenClaw < 2026.2.21 - Arbitrary File Read via grep -e Flag Policy BypassEPSS 0.3%CVE-2026-43532MEDIUMOpenClaw 2026.4.7 < 2026.4.10 - Sandbox Media Normalization Bypass via Discord Event Cover ImageEPSS 0.3%CVE-2026-32017MEDIUMOpenClaw < 2026.2.19 - Arbitrary File Write via Short-Option Bypass in exec AllowlistEPSS 0.3%CVE-2026-35410MEDIUMDirectus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication FlowEPSS 0.3%CVE-2026-50251MEDIUMAttacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flushEPSS 0.3%CVE-2026-53861MEDIUMOpenClaw < 2026.5.6 - Allowlist Bypass via Combined POSIX Inline Flags on macOSEPSS 0.2%CVE-2026-31952HIGHXibo CMS API has SQL Injection via DataSet Filter ParameterEPSS 0.2%CVE-2026-53864HIGHOpenClaw < 2026.5.26 - Insufficient Environment Variable Sanitization in Node.js Control VariablesEPSS 0.2%CVE-2026-26067MEDIUMOctober: Safe Mode Bypass via CSS Preprocessor CompilersEPSS 0.2%CVE-2026-73492LOWLoofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolonsEPSS 0.2%CVE-2026-73491LOWLoofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character referencesEPSS 0.2%CVE-2026-73650HIGHSVGO: removeScripts plugin leaves some executable scripts intactEPSS 0.2%