Falhas do tipo CWE-20

5.453 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2026-36175MEDIUMAn issue in the U-Boot component of GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass authentication and gain root access viaEPSS 0.3%CVE-2026-14100MEDIUMInsufficient data validation in NetworkCache in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data viaEPSS 0.3%CVE-2026-44379MEDIUMMISP: Improper UUID validation in MISP CollectionsEPSS 0.3%CVE-2026-56678MEDIUM9Router: Kiro region injection allows authenticated SSRF with Authorization header forwardingEPSS 0.3%CVE-2022-3388HIGHInput Validation Vulnerability in Hitachi Energy’s MicroSCADA Pro/X SYS600 ProductsEPSS 0.3%CVE-2026-20257MEDIUMImproper Input Validation through Classic Dashboard CSS in Splunk EnterpriseEPSS 0.3%CVE-2026-13893MEDIUMInsufficient validation of untrusted input in WebUI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin dEPSS 0.3%CVE-2026-0282LOWPAN-OS: File Deletion Vulnerability in Management Web InterfaceEPSS 0.3%CVE-2024-27896HIGHInput verification vulnerability in the log module. Impact: Successful exploitation of this vulnerability can affect integrity.EPSS 0.3%CVE-2025-1440MEDIUMAdvanced iFrame <= 2024.5 - Unauthenticated Settings UpdateEPSS 0.3%CVE-2025-12946MEDIUMImproper input validation in NETGEAR Nighthawk routersEPSS 0.3%CVE-2026-79076MEDIUMImproper input validation in Sync in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via crafEPSS 0.3%CVE-2026-101015MEDIUMTrusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in inputEPSS 0.3%CVE-2025-66201HIGHLibreChat is Vulnerable to Server-Side Request Forgery (SSRF) in Actions CapabilityEPSS 0.3%CVE-2025-15606HIGHDenial of Service (DoS) in HTTPD Input Handling on TP-Link TD-W8961NEPSS 0.3%CVE-2026-13872CRITICALInsufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to EPSS 0.3%CVE-2025-63783HIGHA Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC project mutation APIs (update, delete, add/remove tag) oEPSS 0.3%CVE-2024-10302MEDIUMImproper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data ExposureEPSS 0.3%CVE-2026-53537LOWPython-Multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parametersEPSS 0.3%CVE-2026-33471CRITICALnimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncationEPSS 0.3%