CWE-20: Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- sangoma freepbx, freepbx security-reporting +1 moreFreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)8.6 High
- sailpoint technologies identityiqSailPoint IdentityIQ Improper Form Validation Vulnerability9.6 Critical
- agentverus agentverus-scanneragentverus agentverus-scanner context.js isSecurityDefenseSkill reliance on untrusted inputs in a security decision2.4 Low
- manageengine ddi centralAuthenticated PowerShell Injection in DNS Query Resolution Policy leads to RCE7.2 High
- manageengine ddi centralAuthenticated PowerShell Injection leads to RCE8.8 High
- trusted domain project opendmarcTrusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input6.9 Medium
- barco clickshare cx-20 gen2Barco ClickShare CX-20 Gen2 Wallpaper Upload wallpaper improper validation of syntactic correctness of input7.1 High
- citrix netscaler gateway, citrix netscaler adc, gateway +1 more +3 moreFeature policy bypass due to improper HTTP URL based expression usage7.0 High
- citrix netscaler, netscaler gateway, citrix netscaler adc +2 more +4 moreA remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands9.5 Critical
- circl vulnerability-lookupVulnerability-Lookup - Race Condition in Account Recovery Token Consumption Allows Password Takeover6.3 Medium
- edgelesssys contrastContrast before 1.23.1 Image Substitution via Policy Generation8.6 High
- nodemailerNodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment6.9 Medium
- nettyNetty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion8.7 High
- nettyNetty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/38.7 High
- vllmvLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids8.2 High
- vllmvLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt6.9 Medium
- google chromeImproper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowed a remote...6.5 Medium
- google chromeImproper input validation in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote...8.3 High
- google chromeImproper input validation in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote...5.4 Medium
- google chromeImproper input validation in Desktop in Google Chrome prior to 154.0.8037.57 allowed a remote...8.3 High
- google chromeImproper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remote...8.3 High
- zammadZammad: Remote image tracking bypass via shortened URL scheme5.3 Medium
- zammadZammad: AI Agent template sanitizer bypass leads to remote code execution8.6 High
- zammadZammad: Malicious input in Ticket Body Enables Session Termination5.3 Medium
- golang.org/x/playgroundMalicious user input may lead to RCE in golang.org/x/playground8.8 High
- langchain4jlangchain4j LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerializer.fromJson deserialization2.1 Low
- piwigoPiwigo arbitrary file read and remote code execution via insecure image processing7.2 High
- ail project frameworkAIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain Validation6.9 Medium
- ail project frameworkAil Framework Crawler: Missing Cookiejar Authorization Check Allows Cross-Organization Cookiejar Attachment6.3 Medium
- No product listedOpen-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization6.9 Medium
- mongodb python driverForced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption5.3 Medium
- discourseDiscourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist5.4 Medium
- hcl software sametimeInsufficient Input Sanitization is addressed in HCL Sametime 12.0.4. It is recommended to upgrade to the latest version.4.3 Medium
- ibm powervm hypervisor, power system e1050 \(9043-mrx\) firmware, power system e1080 \(9080-hex\) firmware +24 more +26 moreThis Power System update is being released to address5.1 Medium
- rapid7 velociraptorVelociraptor Prefetch parser out of bounds3.6 Low
- halo-dev halohalo-dev Halo SpEL ReplyNotificationSubscriptionHelper.java neutralization6.9 Medium
- No product listedAn issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary...8.8 High
- klever-io klever-goKlever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS7.0 High
- moquetteMoquette fails open when configured authentication or authorization classes cannot load9.3 Critical
- moquetteMoquette client IDs can cause cross-session H2 durable-queue corruption8.8 High
- moquetteMoquette publishes Last-Will messages without enforcing write authorization8.7 High
- moquetteMoquette unbounded per-session message queues allow memory exhaustion8.7 High
- moquetteMoquette deeply nested MQTT topics can cause stack exhaustion8.7 High
- moquetteMoquette malformed shared subscriptions can crash command processing8.7 High
- moquetteMoquette uncaught MQTT command exceptions can terminate shared session event loops8.7 High
- moquetteMoquette pattern ACL wildcard injection allows cross-tenant authorization bypass9.6 Critical
- opnsense core, redaxo +1 moreREDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration4.3 Medium
- zohocorp manageengine applications managerBroken Access Control vulnerability7.1 High
- zohocorp manageengine applications managerBroken Authentication Vulnerability8.1 High
- zohocorp manageengine opmanager, manageengine firewall analyzer +1 moreData Exposure vulnerability7.4 High
- Show moreLoading…