Fallos del tipo CWE-20

5439 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2026-81662HIGHFlowintel Alert Settings Configuration Allows Remote Code Execution via Arbitrary Configuration KeysEPSS 0.5%CVE-2022-41909MEDIUMSegfault in `CompositeTensorVariantToComponents` in TensorflowEPSS 0.5%CVE-2024-9507MEDIUMContact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.15.2 - Authenticated (Administrator+) Improper Input Validation via iconUpload Function to Arbitrary File ReadEPSS 0.5%CVE-2021-36402MEDIUMIn Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk.EPSS 0.5%CVE-2026-67974HIGHA parser boundary flaw in the Software Bus Network (SBN) application's peer subscription message handling in NASA cFS v7.0.1 allows attackerEPSS 0.5%CVE-2026-11386CRITICALubuntu-pro-client Input Validation Vulnerability Leading to Arbitrary APT Directive Injection and Remote Code ExecutionEPSS 0.5%CVE-2025-52568HIGHNeKernal Multiple Memory Corruption Vulnerabilities in mkfs.hefsEPSS 0.5%CVE-2019-1918HIGHCisco IOS XR Software Intermediate System–to–Intermediate System Denial of Service VulnerabilityEPSS 0.5%CVE-2026-2996HIGHAdvanced Product Fields (Product Addons) for WooCommerce <= 1.6.21 - Unauthenticated Improper Input Validation to Price Bypass via Add-to-Cart POST RequestEPSS 0.5%CVE-2022-32243—When a user opens manipulated Scalable Vector Graphics (.svg, svg.x3d) files received from untrusted sources in SAP 3D Visual Enterprise VieEPSS 0.5%CVE-2022-32235—When a user opens manipulated AutoCAD (.dwg, TeighaTranslator.exe) files received from untrusted sources in SAP 3D Visual Enterprise Viewer,EPSS 0.5%CVE-2026-59881MEDIUMAIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflateEPSS 0.5%CVE-2026-21282MEDIUMAdobe Commerce | Improper Input Validation (CWE-20)EPSS 0.5%CVE-2022-35171—When a user opens manipulated JPEG 2000 (.jp2, jp2k.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the appliEPSS 0.5%CVE-2026-15724HIGHPath traversal in Progress ShareFile Storage Zones Controller (SZC)EPSS 0.5%CVE-2026-81633MEDIUMUnhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segmentEPSS 0.5%CVE-2024-21627HIGHSome attribute not escaped in Validate::isCleanHTML methodEPSS 0.5%CVE-2026-25514HIGHFacturaScripts has SQL Injection vulnerability in Autocomplete ActionsEPSS 0.5%CVE-2022-39016HIGHJavascript injection in PDFtron in M-Files HubshareEPSS 0.5%CVE-2026-16421HIGHInappropriate implementation in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code insideEPSS 0.5%