Falhas do tipo CWE-1286

95 resultados

Validação Inadequada da Sintaxe de Entrada

A aplicação aceita entrada do usuário sem validar corretamente se ela segue a sintaxe esperada, permitindo dados malformados ou injetados chegarem até o processamento. Isso abre caminho para injeção de código, parsing incorreto ou comportamento imprevisto, já que o sistema assume que a entrada é segura sem verificar sua estrutura.

Exemplo

Um formulário recebe uma data que deveria estar em formato DD/MM/AAAA, mas aceita qualquer string sem validar — como '32/13/abc' ou ''; e'; DROP TABLE users; --'. O backend processa isso diretamente sem checar sintaxe, causando erros lógicos ou injeção SQL.

Como mitigar

Implemente validação de entrada no lado servidor antes de qualquer processamento: verifique formato (regex, parser dedicado), tipos de dados, comprimento e caracteres permitidos. Use bibliotecas de parsing que rejeitam entrada malformada, nunca confie em validação frontend.

CVE-2025-46419MEDIUMWestermo WeOS 5 through 5.23.0 allows a reboot via a malformed ESP packet.EPSS 0.4%CVE-2026-83611MEDIUMxmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing contentEPSS 0.4%CVE-2026-50131HIGHFedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 rangesEPSS 0.4%CVE-2026-33778HIGHJunos OS: SRX Series, MX Series: When a specifically malformed first ISAKMP packet is received kmd/iked crashesEPSS 0.3%CVE-2026-40198HIGHNet::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypassEPSS 0.3%CVE-2025-36262MEDIUMIBM Planning Analytics Local information disclosureEPSS 0.3%CVE-2023-21405MEDIUMDenial-of-Service vulnerability in Axis Network Door Controller's and Axis Network Intercom's OSDP communicationEPSS 0.3%CVE-2024-6284MEDIUMImproper IPv4 and IPv6 byte order storage in github.com/google/nftablesEPSS 0.3%CVE-2026-20114MEDIUMA vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated, remote attacker to eEPSS 0.3%CVE-2020-16220—Philips Patient Monitoring Devices Improper Validation of Syntactic Correctness of InputEPSS 0.3%CVE-2026-88009HIGHTraefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access loggingEPSS 0.3%CVE-2023-44204MEDIUMJunos OS and Junos OS Evolved: The rpd will crash upon receiving a malformed BGP UPDATE messageEPSS 0.3%CVE-2025-67492MEDIUMWeblate's over‑permissive webhook endpoint enables mass repository updates and component enumerationEPSS 0.3%CVE-2026-0931MEDIUMDenial-of-service vulnerability in M-Files ServerEPSS 0.2%CVE-2021-4479MEDIUMDräger Atlan A350 1.00 <= 1.01 DoS via Medibus InterfaceEPSS 0.2%CVE-2019-25723MEDIUMDräger Perseus A500 2.00-2.02 DoS via Medibus InterfaceEPSS 0.2%CVE-2026-0983HIGHDenial of service vulnerability in M-Files ServerEPSS 0.2%CVE-2026-69211MEDIUMHttp4s: Set-Cookie rendering does not escape attribute delimitersEPSS 0.2%CVE-2023-6950LOWAn Improper Input Validation vulnerability affecting the FTP service running on the DJI Mavic Mini 3 Pro could allow an attacker to craft a EPSS 0.2%CVE-2026-55767MEDIUMGuzzle: Dot-Only Cookie Domains Match All Hosts in guzzlehttp/guzzleEPSS 0.2%