Fallos del tipo CWE-20

5386 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2023-23560CRITICALIn certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation.EPSS 13.9%CVE-2026-41268HIGHFlowise: Flowise Parameter Override Bypass Remote Command ExecutionEPSS 13.8%CVE-2017-12240CRITICALThe DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticatEPSS 13.8%KEVCVE-2023-3676HIGHKubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalationEPSS 13.2%CVE-2018-1058—A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account couEPSS 13.1%CVE-2020-3387HIGHCisco SD-WAN vManage Software Remote Code Execution VulnerabilityEPSS 13.0%CVE-2026-3576HIGHPlanyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' ParameterEPSS 12.9%CVE-2023-28324HIGHA improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege escalation or remote cEPSS 12.9%CVE-2023-21434MEDIUMImproper input validation vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to execute JavaScript by launching EPSS 12.9%CVE-2019-3871MEDIUMA vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from theEPSS 12.6%CVE-2023-36049HIGH.NET, .NET Framework, and Visual Studio Elevation of Privilege VulnerabilityEPSS 12.5%CVE-2023-26068CRITICALCertain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4).EPSS 11.6%CVE-2020-12001—FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ContEPSS 11.5%CVE-2014-3480MEDIUMThe cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, dEPSS 11.5%CVE-2020-24432MEDIUMAcrobat Reader DC Arbitrary JavaScript Execution in PDF DocumentsEPSS 11.1%CVE-2018-1140MEDIUMA missing input sanitization flaw was found in the implementation of LDP database used for the LDAP server. An attacker could use this flaw EPSS 10.8%CVE-2025-49719HIGHMicrosoft SQL Server Information Disclosure VulnerabilityEPSS 10.8%CVE-2024-27612MEDIUMNumbas editor before 7.3 mishandles editing of themes and extensions.EPSS 10.7%CVE-2019-10969—Moxa EDR 810, all versions 5.1 and prior, allows an authenticated attacker to abuse the ping feature to execute unauthorized commands on theEPSS 10.6%CVE-2025-54123CRITICALHoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementationEPSS 10.5%