CWE-20: Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- eric teubert podlove podcast publisherPodlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter9.8 Critical
- netgear wax333Authenticated users can make unauthorized changes on NETGEAR WAX333 Access Points4.3 Medium
- netgear raxe450, raxe500 +1 morePost-authenticated command injection vulnerability found in certain NETGEAR RAX models5.4 Medium
- netgear dgnd3700v1Insufficient input validation vulnerability in NETGEAR DGND3700v1 modem router6.3 Medium
- netgear rax43, rax45, rax50 +2 more +4 morePost-authentication Command Injection Vulnerability in certain Nighthawk RAX series models4.7 Medium
- microsoft word, 365 apps, 365 apps for enterprise +15 more +17 moreMicrosoft Word Information Disclosure Vulnerability5.5 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +14 more +16 moreWindows Win32k Elevation of Privilege Vulnerability8.8 High
- opencostOpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows NTFS Remote Code Execution Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2012 +12 more +14 moreDHCP Server Service Remote Code Execution Vulnerability8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2012 +12 more +14 moreWindows Server Update Service (WSUS) Tampering Vulnerability7.5 High
- microsoft excel, 365 apps, 365 apps for enterprise +11 more +13 moreMicrosoft Excel Remote Code Execution Vulnerability7.8 High
- eclipse jettyEclipse Jetty: HTTP Authority/Host mismatch5.3 Medium
- eclipse kuksa, eclipse foundation kuksa - databroker +1 moreDatabroker 0.6.1 PublishValue missing data_point panic4.3 Medium
- apolloconfig apolloApollo ConfigService access key authentication bypass via raw config file appId parsing7.5 High
- apolloconfig apolloApollo ConfigService access key authentication bypass via appId parsing and non-canonical matching7.5 High
- evbee dc-80Arbitrary file overwrite through certificate update functionality9.3 Critical
- akariasai self-ragAkariAsai self-rag retrieval_lm index.py Indexer.deserialize_from deserialization5.3 Medium
- yashbhalgat hashnerf-pytorchyashbhalgat HashNeRF-pytorch Checkpoint File run_nerf.py torch.load deserialization4.8 Medium
- yzhao062 pyodyzhao062 pyod persistence.py pyod.utils.persistence.load deserialization5.3 Medium
- xtreeme planyo online reservation systemPlanyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter7.2 High
- apache software foundation iotdb c++ clientApache IoTDB C++ client: Out-of-bounds reads in C++ client TsBlock deserializer crash client process on malformed server data7.5 High
- brainstormforce sureforms – drag & drop contact form & form builder, payment form, survey, quiz & calculatorSureForms – Drag and Drop Form Builder for WordPress <= 2.2.1 - Unauthenticated Stripe Payment Amount Manipulation7.5 High
- pimcorePimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation7.1 High
- palo alto networks cloud ngfw, pan-os, prisma access +1 more +3 morePAN-OS: File Deletion Vulnerability in Management Web Interface2.7 Low
- enchant97 note-markNote Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)8.6 High
- No product listedAn improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9...7.5 High
- No product listedAn insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5...9.8 Critical
- No product listedAn input validation vulnerability in the RTSP service of MERCURY MIPC252W IP Camera v1.0.5 Build...6.5 Medium
- google chromeInappropriate implementation in Navigation in Google Chrome prior to 150.0.7871.115 allowed a...4.3 Medium
- google chromeInsufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.115 allowed a...4.3 Medium
- google chromeInsufficient validation of untrusted input in Codecs in Google Chrome on Windows prior to 150.0...8.3 High
- google chromeInsufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to...3.3 Low
- davenardella snap7davenardella snap7 ReadVar Request s7_server.cpp PerformFunctionRead out-of-bounds write5.3 Medium
- libp2p js-libp2plibp2p: CPU DoS via oversized IHAVE and IWANT control message arrays7.5 High
- dspaceDSpace: ORE resource URI does not validate scheme for non-web resources4.4 Medium
- dignifiedquire async-tarasync-tar PAX extension-header desync enables tar entry/content smuggling6.3 Medium
- canonical ubuntuSandbox Escape in Ubuntu OpenJDK Packages via xdg-desktop-portal8.8 High
- guzzle psr7, guzzlephp psr-7 +1 moreguzzlehttp/psr7: Host Confusion via Weak URI Host Validation4.2 Medium
- apache software foundation gravitinoApache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter9.1 Critical
- academysoftwarefoundation openexrOpenEXR: OpenEXRCore exr_attr_set_bytes() accepts NULL type_hint with positive hint_length6.9 Medium
- @better-auth sso, better-auth, better-auth better auth +1 more +3 moreBetter Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration9.6 Critical
- vllmvLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection7.5 High
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Input Validation (CWE-20)10.0 Critical
- apache camelApache Camel: CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input7.3 High
- apache camelApache Camel: Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input7.3 High
- apache camelApache Camel: langchain4j-tools: filter tool argument headers against declared parameters7.3 High
- apache camel, apache software foundation camel aws2 sns +1 moreApache Camel AWS2 SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy to align it with sibling components9.8 Critical
- apache camel, apache software foundation camel iggy +1 moreApache Camel Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling cont…7.5 High
- apache camel, apache software foundation camel atmosphere websocket +1 moreApache Camel Atmosphere Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control header…7.5 High
- Show moreLoading…