Fallos del tipo CWE-20

5455 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2026-47201HIGHauthentik: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated userEPSS 0.3%CVE-2025-58361CRITICALPromptcraft Forge Studio's incomplete URL check is vulnerable to XSS via SVGEPSS 0.3%CVE-2024-42175LOWHCL MyXalytics is affected by a weak input validation vulnerabilityEPSS 0.3%CVE-2026-48312MEDIUMCAI Content Credentials | Improper Input Validation (CWE-20)EPSS 0.3%CVE-2026-95382MEDIUMImproper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer processEPSS 0.3%CVE-2026-77190MEDIUMSecurity Advisory 0177EPSS 0.3%CVE-2026-14117MEDIUMInsufficient validation of untrusted input in DevTools in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convEPSS 0.3%CVE-2026-70573HIGHWindows Biometric Service Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-10460CRITICALUnsanitized parameter input leading to SQL Injection vulnerabilityEPSS 0.3%CVE-2026-13961MEDIUMInsufficient validation of untrusted input in DevTools in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convEPSS 0.3%CVE-2026-9985MEDIUMInsufficient validation of untrusted input in Media in Google Chrome on ChromeOS prior to 148.0.7778.216 allowed a remote attacker who had cEPSS 0.3%CVE-2026-13875MEDIUMInsufficient validation of untrusted input in GPU in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had comprEPSS 0.3%CVE-2026-8516MEDIUMInsufficient validation of untrusted input in DataTransfer in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced EPSS 0.3%CVE-2026-9124MEDIUMInsufficient validation of untrusted input in Input in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker who had compromiseEPSS 0.3%CVE-2026-56547LOWAn input reflection vulnerability affects HCL TravelerEPSS 0.3%CVE-2025-24785MEDIUMiTop dashboard vulnerable to denial of serviceEPSS 0.3%CVE-2024-33624MEDIUMImproper input validation for some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow an unauthenticated userEPSS 0.3%CVE-2026-11016MEDIUMInsufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised EPSS 0.3%CVE-2026-10912MEDIUMInsufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromisEPSS 0.3%CVE-2024-38811HIGHCode-execution vulnerabilityEPSS 0.3%