Falhas do tipo CWE-20

5.842 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2020-3161CRITICALCisco IP Phones Web Server Remote Code Execution and Denial of Service VulnerabilityEPSS 83.9%KEVCVE-2026-88771CRITICALA remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commandsEPSS 81.9%KEVCVE-2023-2915HIGHRockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation VulnerabilityEPSS 81.8%CVE-2025-34300CRITICALSawtooth Software Lighthouse Studio < 9.16.14 Pre-Authentication RCEEPSS 81.3%CVE-2024-47076HIGHlibcupsfilters's cfGetPrinterAttributes5 does not validate IPP attributes returned from an IPP serverEPSS 79.9%CVE-2026-21858CRITICALn8n Vulnerable to Unauthenticated File Access via Improper Webhook Request HandlingEPSS 78.2%CVE-2023-36899HIGHASP.NET Elevation of Privilege VulnerabilityEPSS 76.7%CVE-2024-22120CRITICALTime Based SQL Injection in Zabbix Server Audit LogEPSS 76.6%CVE-2020-3247CRITICALMultiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big DataEPSS 75.6%CVE-2020-3248CRITICALMultiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big DataEPSS 74.4%CVE-2020-3239CRITICALMultiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big DataEPSS 73.6%CVE-2018-8414HIGHA remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code ExEPSS 72.6%KEVCVE-2023-2917CRITICALRockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation VulnerabilityEPSS 72.2%CVE-2012-1535HIGHUnspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote aEPSS 70.4%KEVCVE-2020-13942—Remote Code Execution in Apache UnomiEPSS 68.5%CVE-2023-24950MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 67.5%CVE-2018-16873HIGHIn Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag andEPSS 66.3%CVE-2022-0415CRITICALRemote Command Execution in uploading repository file in gogs/gogsEPSS 65.9%CVE-2019-12630MEDIUMCisco Security Manager Java Deserialization VulnerabilityEPSS 65.8%CVE-2024-0507MEDIUMPrivilege Escalation by Code Injection in the Management Console in GitHub Enterprise ServerEPSS 65.8%