Fallos del tipo CWE-20

5450 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2025-8573LOWConcrete CMS 9 through 9.4.2 is vulnerable to Stored XSS from Home Folder on Members Dashboard pageEPSS 0.4%CVE-2026-37458MEDIUMMissing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticated attackers to causEPSS 0.4%CVE-2025-20183MEDIUMCisco Secure Web Appliance Range Request Bypass VulnerabilityEPSS 0.4%CVE-2022-43562LOWHost Header Injection in Splunk EnterpriseEPSS 0.4%CVE-2025-7099MEDIUMBoyunCMS Installation install2.php deserializationEPSS 0.4%CVE-2025-65561HIGHAn issue was discovered in function LocalNode.Sess in free5GC 4.1.0 allowing attackers to cause a denial of service or other unspecified impEPSS 0.4%CVE-2026-33882MEDIUMStatamic's Markdown preview endpoint exposes sensitive user dataEPSS 0.4%CVE-2026-54217MEDIUMTeamDavid: Stored XSS in web applicationEPSS 0.4%CVE-2021-4120HIGHsnapd could be made to bypass intended access restrictions through snap content interfaces and layout pathsEPSS 0.4%CVE-2023-30952MEDIUMFoundry Issues reporterPath phishing by parameter injectionEPSS 0.4%CVE-2021-39254MEDIUMA crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in the function ntfs_attr_record_resiEPSS 0.4%CVE-2024-34473MEDIUMAn issue was discovered in appmgr in O-RAN Near-RT RIC I-Release. An attacker could register an unintended RMR message type during xApp regiEPSS 0.4%CVE-2021-41133HIGHSandbox bypass via recent VFS-manipulating syscallsEPSS 0.4%CVE-2023-25661MEDIUMDenial of Service in TensorFlowEPSS 0.4%CVE-2024-51392HIGHAn issue in OpenKnowledgeMaps Headstart v7 allows a remote attacker to escalate privileges via the url parameter of the getPDF.php componentEPSS 0.4%CVE-2025-41379MEDIUMInjection vulnerability in Iridium Certus 700EPSS 0.4%CVE-2023-40314MEDIUMCross-site scripting in bootstrap.jspEPSS 0.4%CVE-2026-70322MEDIUMPowerpoint Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-56831MEDIUMShopper: Negative discount values accepted and propagated through order calculation pipelineEPSS 0.4%CVE-2026-70320MEDIUMPowerpoint Information Disclosure VulnerabilityEPSS 0.4%