Fallos del tipo CWE-20

5449 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2026-45636HIGHWindows NTFS Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-26143HIGHMicrosoft PowerShell Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2026-55899HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2021-0267HIGHJunos OS: Receipt of a crafted DHCP packet will cause the jdhcpd DHCP service to core.EPSS 0.5%CVE-2022-38985HIGHThe facial recognition module has a vulnerability in input validation.Successful exploitation of this vulnerability may affect data confidenEPSS 0.5%CVE-2026-61711MEDIUMBuildKit: Custom frontend could bypass Seccomp/AppArmorEPSS 0.5%CVE-2024-25656MEDIUMImproper input validation in AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS can result in unauthenticated CPE (Customer PremisEPSS 0.5%CVE-2026-76711HIGHUnauthenticated Remote Data Injection Vulnerability in HPE Networking Analytics and Location Engine (ALE)EPSS 0.5%CVE-2023-23409MEDIUMClient Server Run-Time Subsystem (CSRSS) Information Disclosure VulnerabilityEPSS 0.5%CVE-2023-32463LOW Dell VxRail, version(s) 8.0.100 and earlier contain a denial-of-service vulnerability in the upgrade functionality. A remote unauthenticateEPSS 0.5%CVE-2025-5878MEDIUMESAPI esapi-java-legacy SQL Injection Defense Encoder.encodeForSQL special elementEPSS 0.5%CVE-2025-6547CRITICALOn Node.js < 3, pbkdf2 silently disregards Uint8Array input, returning static keysEPSS 0.5%CVE-2022-41891MEDIUMSegfault in `tf.raw_ops.TensorListConcat` in TensorflowEPSS 0.5%CVE-2025-1022HIGHVersions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by BrowEPSS 0.5%CVE-2026-78900CRITICALImproper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code oEPSS 0.5%CVE-2026-85047CRITICALImproper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentiallEPSS 0.5%CVE-2024-30110LOWLack of input validation vulnerability affects DRYiCE AEX v10EPSS 0.5%CVE-2025-34157CRITICALCoolify Stored Cross-Site Scripting (XSS) in Project Name FieldEPSS 0.5%CVE-2026-76035CRITICALInappropriate implementation in Media in Google Chrome on on Mac prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary codeEPSS 0.5%CVE-2026-57130HIGHPraisonAI: IMAP Command Injection via Unsanitized Email Search ParametersEPSS 0.5%