Fallos del tipo CWE-20

5453 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2026-63428MEDIUMHeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's declared hidden-field setEPSS 0.3%CVE-2025-43375HIGHThe issue was addressed with improved checks. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process.EPSS 0.3%CVE-2014-0762—CG Automation ePAQ-9410 Substation Gateway Improper Input ValidationEPSS 0.3%CVE-2022-29206MEDIUMMissing validation results in undefined behavior in `SparseTensorDenseAdd` in TensorFlowEPSS 0.3%CVE-2025-59940MEDIUMmkdocs-include-markdown-plugin susceptible to unvalidated input colliding with substitution placeholdersEPSS 0.3%CVE-2026-42261HIGHPromptHub: Authenticated SSRF via IPv6 filter bypass in `POST /api/skills/fetch-remote`EPSS 0.3%CVE-2026-100177MEDIUMAil Framework Crawler: Missing Cookiejar Authorization Check Allows Cross-Organization Cookiejar AttachmentEPSS 0.3%CVE-2024-35384MEDIUMAn issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_array_length function in the mjs.c file.EPSS 0.3%CVE-2026-2695MEDIUMLack of Server-side validation in Instruction Input in TeamViewer DEX Platform (On-Premises)EPSS 0.3%CVE-2024-2536MEDIUMRank Math SEO with AI SEO Tools <= 1.0.214 - Authenticated(Contributor+) Stored Cross-Site Scripting via HowTo block attributesEPSS 0.3%CVE-2024-6541MEDIUMInformation Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 ProductsEPSS 0.3%CVE-2021-1432HIGHCisco IOS XE SD-WAN Software Arbitrary Command Execution VulnerabilityEPSS 0.3%CVE-2025-56404HIGHAn issue was discovered in MariaDB MCP 0.1.0 allowing attackers to gain sensitive information via the SSE service as the SSE service lacks uEPSS 0.3%CVE-2014-2346—COPA-DATA zenon DNP3 Improper Input ValidationEPSS 0.3%CVE-2026-91738CRITICALImproper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code oEPSS 0.3%CVE-2020-16237LOWPhilips SureSigns VS4 Improper Input ValidationEPSS 0.3%CVE-2023-38654HIGHImproper input validation for some some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.20 may allow an unauthenticatedEPSS 0.3%CVE-2026-46341MEDIUMApify MCP server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix MatchingEPSS 0.3%CVE-2024-0126HIGHNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability which could allow a privileged attacker to escalate permissions. A EPSS 0.3%CVE-2022-4332MEDIUMSprecher: Vulnerable firmware verificationEPSS 0.3%