Weakness (CWE)
CWE-20: Improper Input Validation
The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process the data safely and
correctly.
How to prevent it (8 mitigations)
-
Architecture and Design
Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
-
Architecture and Design
Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
-
Architecture and Design, Implementation
Understand all the potential areas where untrusted inputs can enter the product, including but not limited to: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls.
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
-
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Even though client-side checks provide minimal benefits with respect to server-side security, they are still useful. First, they can support intrusion detection. If the server receives input that should have been rejected by the client, then it may be an indication of an attack. Second, client-side error-checking can provide helpful feedback to the user about the expectations for valid input. Third, there may be a reduction in server-side processing time for accidental input errors, although this is typically a small savings.
-
Implementation
When your application combines data from multiple sources, perform the validation after the sources have been combined. The individual data elements may pass the validation step but violate the intended restrictions after they have been combined.
-
Implementation
Be especially careful to validate all input when invoking code that crosses language boundaries, such as from an interpreted language to native code. This could create an unexpected interaction between the language boundaries. Ensure that you are not violating any of the expectations of the language with which you are interfacing. For example, even though Java may not be susceptible to buffer overflows, providing a large argument in a call to native code might trigger an overflow.
-
Implementation
Directly convert your input type into the expected data type, such as using a conversion function that translates a string into a number. After converting to the expected data type, ensure that the input's values fall within the expected range of allowable values and that multi-field consistencies are maintained.
Source: MITRE CWE-20
2,642 results · Clear filters · Feed
-
High 8.2
Dimension | Improper Input Validation (CWE-20)
Dimension is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this is…
-
High 7.7
Audition | Improper Input Validation (CWE-20)
Audition is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond t…
-
High 8.6
Audition | Improper Input Validation (CWE-20)
Audition is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires us…
-
High 8.6
Audition | Improper Input Validation (CWE-20)
Audition is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires us…
-
High 8.6
After Effects | Improper Input Validation (CWE-20)
After Effects is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requir…
-
High 7.5
In multiple locations, there is a possible way to trigger an out of bounds read and temporary denial of service due to …
-
High 7.5
In multiple locations, there is a possible way to trigger a temporary denial of service via an integer overflow trap du…
-
High 7.5
Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parser
The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to ca…
-
High 7.5
hickory-dns from 0.20.1 before 0.26.2 Panic in SVCB/HTTPS Zone File Parser
hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter …
-
High 7.3
OpenBMB Internet of Agents Agent Registry milvus_utils.py _primary_field_query data query logic injection
A vulnerability was detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function _primary_field_query of the file common/utils/milvus_utils.py of the component Agent Registry. The manipulation of the argumen…
-
High 8.8
SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full database
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR_Report::build_report_query_where incorporates a report editor's parameter_value when value_type=Field without sufficient …
-
High 7.2
Incorrect Authorization in Altium 365 Git Service Allows Unauthorized Repository Writes
An incorrect authorization vulnerability exists in the Altium 365 Git Service. The permission check performed when a user pushes to a project repository did not correctly evaluate the required access level, so the check passed for any user holding any level o…
-
High 8.1
Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokens
Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges id…
-
High 7.7
Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 1.11.0 until 2.10.0, createTokenFromClientCredentials in backend/internal/service/oidc_service.go accepts the client-controlled resource parameter and embeds…
-
High 8.5
IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer ag…
-
High 7.5
Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal
Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. A user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB w…
-
High 7.5
Improper Input Validation in Modem Firmware
Transient DOS when processing a malformed NR RRC configuration message due to improper input validation.
-
High 7.8
Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentiall…
-
High 8.8
Improper input validation in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web or…
-
High 8.3
Improper input validation in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromi…
-
High 8.8
Improper input validation in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compro…
-
High 8.8
Improper input validation in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web ori…
-
High 7.4
Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fields
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, …
-
High 8.4
SolarWinds Dameware Buffer Overflow Vulnerability
SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution. Authentication is required.
-
High 7.1
Missing length validation in Absolute Secure Access
CVE-2026-116768 is a missing length validation vulnerability in Secure Access servers prior to 14.61. Authenticated attackers can cause a persistent denial of service when connecting for the first time.
-
High 7.1
Improper input handling in Secure Access servers
CVE-2026-116767 is an improper input handling vulnerability in Secure Access servers prior to 14.61. Authenticated attackers can cause a persistent denial of service.
-
High 8.3
Improper input handling in Secure Access server
CVE-2026-116766 is an improper input handling vulnerability in the Secure Access server versions between 13.0 and prior to 14.61. Attackers can cause a persistent denial of service of the server.
-
High 8.4
In checkDestination of SmsUsageMonitor.java, there is a possible permission bypass due to improper input validation. Th…
-
High 7.5
In multiple locations, there is a possible denial of service due to improper input validation. This could lead to remot…
-
High 7.5
In parseChunk of MPEG4Extractor.cpp, there is a possible denial of service due to improper input validation. This could…
-
High 8.4
In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible policy d…
-
High 7.8
In multiple functions of MmiUtils.java, there is a possible risk of USSD/MMI code execution due to improper input valid…
-
High 8.4
In onCreate of SettingsApplication.java, there is a possible cross-profile consent dialog label injection due to improp…
-
High 8.4
In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper in…
-
High 7.5
A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module. The w_rx_aar_register() f…
-
High 8.2
AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers
### Summary AdminNeo versions 4.6.0 through at least 5.5.0 are vulnerable to cookie attribute injection via the `X-Forwarded-Prefix` HTTP header. An attacker who can influence this header (e.g., through a reverse proxy that forwards it from clients, an attack…
-
High 8.8
IXP Manager has authenticated non-administrator privilege escalation
IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated, non-administrative user can elevate their privileges to administrator status. Restricting administrative functions reduces exposure bu…
-
High 7.9CVE-2026-62958 Public exploit
libriscv: Out of bounds read vuln in the ELF parser (Denial of service)
libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. `Memory<W>::binary_loader` checks `PT_LOAD` program-header bounds, but `Memory<W>::serialize_execute_segment` trusts section-hea…
-
High 8.7
OpenVM: MemoryMerkleAir allows below-leaf rows to alter memory roots
OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `MemoryMerkleAir` does not forbid Merkle expansion rows at `parent_height` = 0 or below while `e…
-
High 7.5
AdminNeo: version-cache array injection causes persistent denial of service
AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated `?script=version` endpoint accepts POST data without origin, CSRF or parameter-type validation. A `version[]` parameter becomes a PHP array that `…