Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1287: Improper Validation of Specified Type of Input

Base Incomplete

The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

How to prevent it (1 mitigation)

  1. Implementation

    Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

    When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."

    Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

Source: MITRE CWE-1287

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-114509 Public exploit

    Laravel TokenGuard authentication bypass through non-string API credentials

    Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can matc…

    laravel framework laravel/framework php-laravel-framework Debian Packagist
  • High 8.1
    CVE-2026-18830 Public exploit

    Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API

    Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocation and security controls via crafted content blocks in conversation messages. AWS has addressed this…

    AWS Amazon Bedrock AgentCore harness
  • High 8.2
    CVE-2025-53652 Public exploit

    Jenkins Git Parameter Plugin vulnerable to code injection due to inexhaustive parameter check

    Jenkins Git Parameter Plugin 439.vb_0e46ca_14534 and earlier does not validate that the Git parameter value submitted to the build matches one of the offered choices, allowing attackers with Item/Build permission to inject arbitrary values into Git parameters.

    Jenkins Project Jenkins Git Parameter Plugin org.jenkins-ci.tools:git-parameter Web / CMS Maven
  • Critical 10.0
    CVE-2024-51550 Public exploit

    Data Validation / Sanitization

    Data Validation / Data Sanitization vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in an Aspect device.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • High 7.5
    CVE-2024-51546 Public exploit

    Credentails Disclosure

    Credentials Disclosure vulnerabilities allow access to on board project back-up bundles.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB NEXUS Series ASPECT-Enterprise MATRIX Series ICS / OT
  • Critical 9.8
    CVE-2024-4879 Exploited Public exploit EPSS 100%

    Jelly Template Injection Vulnerability in ServiceNow UI Macros

    ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. Servi…

    ServiceNow Now Platform
    KEV Jul 29, 2024
  • Critical 10.0
    CVE-2024-6298 Public exploit EPSS 19%

    remote code execution

    Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to execute arbitrary code remotely

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • Medium 4.9
    CVE-2022-31007 Public exploit EPSS 27%

    Privilege escalation from administrator in eLabFTW

    eLabFTW is an electronic lab notebook manager for research teams. Prior to version 4.3.0, a vulnerability allows an authenticated user with an administrator role in a team to assign itself system administrator privileges within the application, or create a ne…

    elabftw elabftw