cve.bz

CWE-20: Improper Input Validation, page 16

Filter

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

What the weakness is: CWE-20 at MITRE

Ask an AI about CWE-20

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-20: Improper Input Validation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/20.html and https://cve.bz/cve/cwe/20?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.3CVE-2026-54207EPSS 0.5%

    Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality (“!ArcEntryMove”) accepts an arbitrary path, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without …

  2. 6.3CVE-2026-54206EPSS 0.5%

    Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a @@INCLUDE command, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without…

  3. 6.3CVE-2026-54205EPSS 0.5%

    Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality (//ServerClient_celink.htm) accepts a “pathname” parameter, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these…

  4. 7.7CVE-2026-54204EPSS 0.6%

    Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot” parameter, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without validation, re…

  5. 5.3CVE-2026-54199EPSS 0.4%

    Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the request body in the application's link storing functionality (//ServerClient_celink.htm), which is appended to the redirect target in the 302 H…

  6. 8.3CVE-2026-19177EPSS 0.3%

    Insufficient validation of untrusted input in UI in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium securit…

  7. 8.8CVE-2026-19169EPSS 0.3%

    Insufficient validation of untrusted input in Contextual Tasks in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)

  8. 9.6CVE-2026-19164EPSS 0.3%

    Insufficient validation of untrusted input in Codecs in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

  9. 8.1CVE-2026-19153EPSS 0.3%

    Insufficient validation of untrusted input in Workers in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity…

  10. 8.6CVE-2026-19143EPSS 0.1%

    Insufficient validation of untrusted input in WebAPKs in Google Chrome on Android prior to 151.0.7922.109 allowed a local attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

  11. 5.3CVE-2026-15149EPSS 0.3%

    The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on client-controlled cart data, allowing unauthenticated users to cre…

  12. 2.7CVE-2026-14225EPSS 0.3%

    The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire str…

  13. 6.8CVE-2024-6541EPSS 0.3%

    The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations …

  14. 1.3CVE-2026-16316EPSS 0.2%

    OMICRON StationGuard 4.00 contains an improper input validation vulnerability in its IEC 61850 Sampled Values (SV) frame processing. A specially crafted SV frame can cause the affected process to terminate, disrupting alert processing for …

  15. 8.1CVE-2026-57817EPSS 0.7%

    The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider (IdP) that omi…

  16. 4.3CVE-2025-13909EPSS 0.3%

    The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants…

  17. 5.8CVE-2024-10302EPSS 0.3%

    The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes. Allowing…

  18. 4.8CVE-2026-71318EPSS 0.3%

    Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level `as` prop to the /__nuxt_island/ endpoint and drive dynamic component resolution through <component :is>, r…

  19. 5.3CVE-2026-70607EPSS 0.6%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open() features string we…

  20. 9.9CVE-2026-20303EPSS 0.5%

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that ad…

  21. 8.6CVE-2026-20273EPSS 0.5%

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that a…

  22. 6.0CVE-2026-70603EPSS 0.1%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath() did not reject paths containing embedded null bytes. Apps that per…

  23. 8.7CVE-2026-46334EPSS 0.7%

    OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidth-line parsing logic. A SIP request with Content-Type: application/sd…

  24. 4.8CVE-2026-70589EPSS 0.3%

    Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offers that were no longer active. This issue is fixed in version 6.54.1.

  25. 8.7CVE-2026-16793EPSS 0.5%

    An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system com…

  26. 9.3CVE-2026-18801EPSS 0.4%

    OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or u…

  27. 5.7CVE-2026-11835EPSS 0.1%

    Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI …

  28. 7.5CVE-2026-67978EPSS 0.3%

    An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via transmitting a crafted SBN frame.

  29. 7.5CVE-2026-67974EPSS 0.5%

    A parser boundary flaw in the Software Bus Network (SBN) application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via sending a crafted packet.

  30. 7.5CVE-2026-67969EPSS 0.4%

    An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMon_Tbl entry.

  31. 6.9CVE-2026-69198EPSS 0.5%

    ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own …

  32. 7.7CVE-2026-69192EPSS 0.5%

    ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and …

  33. 7.5CVE-2026-69185EPSS 0.6%

    Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, whi…

  34. 7.5CVE-2026-21555EPSS 0.7%

    In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

  35. 7.5CVE-2026-21554EPSS 0.7%

    In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

  36. 7.5CVE-2026-21553EPSS 0.7%

    In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

  37. 7.5CVE-2026-21552EPSS 0.7%

    In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

  38. 7.5CVE-2026-21551EPSS 0.7%

    In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

  39. 7.5CVE-2026-21550EPSS 0.7%

    In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

  40. 7.5CVE-2026-21549EPSS 0.7%

    In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

  41. 7.5CVE-2026-21548EPSS 0.7%

    In nr modem, there is a possible improper input validation. This could lead to remote denial of service with System execution privileges needed.

  42. 9.3CVE-2026-59650EPSS 0.3%

    In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

  43. 8.8CVE-2025-71399EPSS 0.5%

    Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to…

  44. 9.4CVE-2026-67330EPSS 0.6%

    @better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO,…

  45. 7.3CVE-2026-67326EPSS 0.3%

    GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] sect…

  46. 8.7CVE-2026-67296EPSS 0.5%

    FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation. A malicious RDP client can send a header-only RDPEI message with …

  47. 5.3CVE-2026-54909EPSS 0.6%

    pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. T…

  48. 6.9CVE-2026-53551EPSS 0.7%

    free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF (Authentication Server Function) does not validate the supiOrSuci field in UE authentication requests. Null bytes (\x00) and other control ch…

  49. 7.5CVE-2026-53503EPSS 0.8%

    Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the user-controlled <columns> value to a C extension (thumbor/ext/filters/…

  50. 4.3CVE-2025-62347EPSS 0.3%

    HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unexpected system behavior and potential security bypasses. This was caused by an implementation flaw in an architectural security tactic that fails …