Falhas do tipo CWE-1286

109 resultados

Validação Inadequada da Sintaxe de Entrada

A aplicação aceita entrada do usuário sem validar corretamente se ela segue a sintaxe esperada, permitindo dados malformados ou injetados chegarem até o processamento. Isso abre caminho para injeção de código, parsing incorreto ou comportamento imprevisto, já que o sistema assume que a entrada é segura sem verificar sua estrutura.

Exemplo

Um formulário recebe uma data que deveria estar em formato DD/MM/AAAA, mas aceita qualquer string sem validar — como '32/13/abc' ou ''; e'; DROP TABLE users; --'. O backend processa isso diretamente sem checar sintaxe, causando erros lógicos ou injeção SQL.

Como mitigar

Implemente validação de entrada no lado servidor antes de qualquer processamento: verifique formato (regex, parser dedicado), tipos de dados, comprimento e caracteres permitidos. Use bibliotecas de parsing que rejeitam entrada malformada, nunca confie em validação frontend.

CVE-2025-24347MEDIUMA vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) EPSS 0.5%CVE-2024-21616HIGHJunos OS: MX Series and SRX Series: Processing of a specific SIP packet causes NAT IP allocation to failEPSS 0.5%CVE-2025-24346HIGHA vulnerability in the “Proxy” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to maEPSS 0.5%CVE-2026-25513HIGHFacturaScripts has SQL Injection vulnerability in API ORDER BY ClauseEPSS 0.5%CVE-2026-6918HIGHIn Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message.EPSS 0.5%CVE-2025-54995MEDIUMAsterisk remotely exploitable leak of RTP UDP ports and internal resourcesEPSS 0.5%CVE-2026-102084CRITICALJunos OS: SRX Series: In an ADVPN scenario a malformed message from a peer causes Remote Code ExecutionEPSS 0.5%CVE-2025-0638HIGHRoutinator crashes when illegal characters are present in manifest file namesEPSS 0.5%CVE-2024-52362MEDIUMIBM App Connect Enterprise Certified Container denial of serviceEPSS 0.5%CVE-2024-39542HIGHJunos OS and Junos OS Evolved: A malformed CFM packet or specific transit traffic leads to FPC crashEPSS 0.5%CVE-2026-57026HIGHJunos OS: MX Series with SPC3, SRX Series: Processing of a specifically malformed SIP invite causes a flowd crashEPSS 0.5%CVE-2025-10954MEDIUMVersions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of InputEPSS 0.5%CVE-2026-110675HIGHCpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hvEPSS 0.5%CVE-2026-88009HIGHTraefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access loggingEPSS 0.4%CVE-2024-8772MEDIUM51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable to a race condition EPSS 0.4%CVE-2025-11573HIGHDenial of Service issue in Amazon.IonDotnetEPSS 0.4%CVE-2026-87082HIGHNet::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycodeEPSS 0.4%CVE-2026-0931MEDIUMDenial-of-service vulnerability in M-Files ServerEPSS 0.4%CVE-2026-110759CRITICALText::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parseEPSS 0.4%CVE-2026-21917HIGHJunos OS: SRX Series: Specifically malformed SSL packet causes FPC crashEPSS 0.4%