Falhas do tipo CWE-20

5.839 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2025-54123CRITICALHoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementationEPSS 10.9%CVE-2024-27612MEDIUMNumbas editor before 7.3 mishandles editing of themes and extensions.EPSS 10.7%CVE-2019-10969—Moxa EDR 810, all versions 5.1 and prior, allows an authenticated attacker to abuse the ping feature to execute unauthorized commands on theEPSS 10.6%CVE-2021-29425MEDIUMPossible limited path traversal vulnerabily in Apache Commons IOEPSS 10.5%CVE-2022-23626HIGHInsufficient file checks in m1k1o/blogEPSS 9.9%CVE-2022-0073HIGHAuthenticated Remote Code Execution in OpenLiteSpeed Web ServerEPSS 9.7%CVE-2024-30087HIGHWin32k Elevation of Privilege VulnerabilityEPSS 9.5%CVE-2025-34102CRITICALCryptoLog Unauthenticated RCE via SQL Injection and Command InjectionEPSS 9.5%CVE-2014-125117CRITICALD-Link info.cgi POST Request Stack-Based Buffer Overflow RCEEPSS 9.3%CVE-2021-43779CRITICALRemote Command Execution vulnerabilityEPSS 9.1%CVE-2025-52905HIGHTOTOLINK X6000R Argument Injection VulnerabilityEPSS 9.1%CVE-2020-13956MEDIUMApache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the liEPSS 9.0%CVE-2026-3576HIGHPlanyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' ParameterEPSS 8.8%CVE-2026-40871HIGHmailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via APIEPSS 8.6%CVE-2015-9235—In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetEPSS 8.5%CVE-2018-0304—A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remotEPSS 8.4%CVE-2024-38189HIGHMicrosoft Project Remote Code Execution VulnerabilityEPSS 8.2%KEVCVE-2023-34152CRITICALA vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes conEPSS 8.0%CVE-2021-25741HIGHSymlink Exchange Can Allow Host Filesystem AccessEPSS 8.0%CVE-2020-29075HIGHPDF Injection BlackHat TalkEPSS 7.9%