Falhas do tipo CWE-20

5.386 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2023-23560CRITICALIn certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation.EPSS 13.9%CVE-2026-41268HIGHFlowise: Flowise Parameter Override Bypass Remote Command ExecutionEPSS 13.8%CVE-2017-12240CRITICALThe DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticatEPSS 13.8%KEVCVE-2023-3676HIGHKubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalationEPSS 13.2%CVE-2018-1058—A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account couEPSS 13.1%CVE-2020-3387HIGHCisco SD-WAN vManage Software Remote Code Execution VulnerabilityEPSS 13.0%CVE-2026-3576HIGHPlanyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' ParameterEPSS 12.9%CVE-2023-28324HIGHA improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege escalation or remote cEPSS 12.9%CVE-2023-21434MEDIUMImproper input validation vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to execute JavaScript by launching EPSS 12.9%CVE-2019-3871MEDIUMA vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from theEPSS 12.6%CVE-2023-36049HIGH.NET, .NET Framework, and Visual Studio Elevation of Privilege VulnerabilityEPSS 12.5%CVE-2023-26068CRITICALCertain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4).EPSS 11.6%CVE-2020-12001—FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ContEPSS 11.5%CVE-2014-3480MEDIUMThe cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, dEPSS 11.5%CVE-2020-24432MEDIUMAcrobat Reader DC Arbitrary JavaScript Execution in PDF DocumentsEPSS 11.1%CVE-2018-1140MEDIUMA missing input sanitization flaw was found in the implementation of LDP database used for the LDAP server. An attacker could use this flaw EPSS 10.8%CVE-2025-49719HIGHMicrosoft SQL Server Information Disclosure VulnerabilityEPSS 10.8%CVE-2024-27612MEDIUMNumbas editor before 7.3 mishandles editing of themes and extensions.EPSS 10.7%CVE-2019-10969—Moxa EDR 810, all versions 5.1 and prior, allows an authenticated attacker to abuse the ping feature to execute unauthorized commands on theEPSS 10.6%CVE-2025-54123CRITICALHoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementationEPSS 10.5%