CWE-20: Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- seppmail secure email gatewayUnicode Subject Tags7.8 High
- seppmail secure email gatewayS/MIME Decryption Impersonation7.8 High
- seppmail secure email gatewayLong Subject Untagging5.3 Medium
- seppmail secure email gatewayBounded Subject Tag Sanitization7.7 High
- seppmail secure email gatewayWebmail Password Tag Sanitization Bypass5.3 Medium
- seppmail secure email gatewayUID Regex Bypass5.3 Medium
- ellanetworks core, ella core +1 moreElla Core Has Audit Log Falsification via Path/Body IMSI Mismatch in UpdateSubscriber2.7 Low
- aio-libs aiohttpAIOHTTP: Duplicate Host header accepted6.3 Medium
- linuxfoundation onnxONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.8.6 High
- cisco unified computing system (standalone), unified computing system +1 moreCisco Integrated Management Controller Remote Code Execution Vulnerability6.5 Medium
- cisco enterprise nfv infrastructure software, unified computing system (standalone), unified computing system e-series software (ucse) +2 moreCisco Integrated Management Controller Authentication Bypass Vulnerability9.8 Critical
- oretnom23 loan management systemA Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to the...6.5 Medium
- google androidStrongBox in Android before security patch level 2026-04-05 has a vulnerability of High Severity,...5.5 Medium
- jahlives openssl encryptopenssl_encrypt before 1.4.0 Schema Validation Bypass9.3 Critical
- phpmyfaqphpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor5.4 Medium
- freescoutFreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout5.4 Medium
- admidioAdmidio: CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter4.3 Medium
- sonicwall email securityA vulnerability exists in the SonicWall Email Security appliance due to improper input...3.8 Low
- sonicwall email securityA denial-of-service (DoS) vulnerability exists due to improper input validation in the SonicWall...2.7 Low
- cato networks socketCato's Socket WebUI is vulnerable to OS Command Injection8.3 High
- tautulliTautulli: SQL Injection in get_home_stats API endpoint via unsanitised filter parameters4.9 Medium
- nginxui nginx ui, 0xjacky nginx-ui +1 moreNginx UI: DoS via Negative Integer Input in Logrotate Interval6.9 Medium
- openairinterfaceOpenAirInterface V2.2.0 AMF crashes when it fails to decode the message. Not all decode failures...7.5 High
- mrcmsMRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file...5.3 Medium
- njzjz wenxianwenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body`9.8 Critical
- brainstormforce sureforms – contact form, payment form & other custom form builderSureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id'7.5 High
AWSSDK.CloudFrontNuGet,AWSSDK.Extensions.CloudFront.SignersNuGet +1 moreAWS SDK for .NET: Improper escaping of special characters in CloudFront policy document construction7.7 Highio.root.software.amazon.awssdk:cloudfrontRoot,software.amazon.awssdk:cloudfrontMaven +1 moreAWS SDK for Java 2.0: Improper Handling of Special Characters in CloudFront Signing Utilities7.7 Highaws/aws-sdk-phpPackagistAWS SDK for PHP has CloudFront Policy Document Injection via Special Characters7.7 High- tlsfuzzer ecdsa, python-ecdsa +1 morepython-ecdsa: Denial of Service via improper DER length validation in crafted private keys5.3 Medium
- globaleaks, globaleaks globaleaks-whistleblowing-software +1 moreGlobalLeaks has insufficient URL validation in user support API1.2 Low
- pretix venuelessUnauthorized access to chat contents7.3 High
- senior-walter web-based pharmacy product management systemA Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in...7.5 High
- senior-walter web-based pharmacy product management systemA Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in...7.5 High
- tianguaduizhang ai codeIn its design for automatic terminal command execution, AI Code offers two options: Execute safe...9.6 Critical
- No product listedA buffer overflow vulnerability exists in the ONVIF GetStreamUri function of LSC Indoor Camera V7...7.2 High
- dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +16 more +18 moreManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be...7.5 High
- dovecot, open-xchange gmbh ox dovecot pro +1 moreWhen sending invalid base64 SASL data, login process is disconnected from the auth server,...5.3 Medium
- digitalbazaar forgenode-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding8.7 High
- digitalbazaar forge, red hat cluster observability operator 1.5.0, cryostat 4 +22 more +24 moreForge has signature forgery in RSA-PKCS due to ASN.1 extra field7.5 High
- statamic cms, statamic +1 moreStatamic's Markdown preview endpoint exposes sensitive user data6.5 Medium
- openfgaOpenFGA has an Authorization Bypass through cached keys5.8 Medium
- hcl aftermarket dpc, hcltech aftermarket cloud +1 moreHCL Aftermarket DPC is affected by Improper Input Validation3.5 Low
- 648540858 wvp-gb28181-pro648540858 wvp-GB28181-pro API Endpoint RedisTemplateConfig.java GenericFastJsonRedisSerializer deserialization6.9 Medium
- openbao, red hat cryostat 4 +1 moreOpenBao has Reflected XSS in its OIDC authentication error message9.4 Critical
- getkirby kirbyWithdrawn Advisory: Kirby CMS has Persistent DoS via Malformed Image Upload6.5 Medium
- protocol buffers protobuf-php (pecl)Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input7.1 High
- harttle liquidjsLiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern7.5 High
- harttle liquidjsLiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash7.5 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreBluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ8.8 High
- Show moreLoading…