cve.bz

CWE-20: Improper Input Validation, page 49

Filter

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

What the weakness is: CWE-20 at MITRE

Ask an AI about CWE-20

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-20: Improper Input Validation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/20.html and https://cve.bz/cve/cwe/20?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.5CVE-2025-7216EPSS 0.5%

    A vulnerability, which was classified as critical, was found in lty628 Aidigu up to 1.8.2. This affects the function checkUserCookie of the file /application/common.php of the component PHP Object Handler. The manipulation of the argument …

  2. 7.5CVE-2025-49719EPSS 15%

    Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network.

  3. 7.8CVE-2025-47982EPSS 0.4%

    Improper input validation in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.

  4. 7.1CVE-2025-40593EPSS 0.4%

    A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0). The affected application allows to control the device by storing arbitrary files in the SFTP folder of the device. This could allow an attacker to cause a denial…

  5. 7.8CVE-2025-24005EPSS 0.1%

    A local attacker with a local user account can leverage a vulnerable script via SSH to escalate privileges to root due to improper input validation.

  6. 5.3CVE-2025-24002EPSS 0.4%

    An unauthenticated remote attacker can use MQTT messages to crash a service on charging stations complying with German Calibration Law, resulting in a temporary denial-of-service for these stations until they got restarted by the watchdog.

  7. 7.5CVE-2025-26780EPSS 0.4%

    An issue was discovered in L2 in Samsung Mobile Processor and Modem Exynos 2400 and Modem 5400. The lack of a length check leads to a Denial of Service via a malformed PDCP packet.

  8. 3.5CVE-2025-3777EPSS 0.4%

    Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability arises from insecure URL validation using the `startswith()` method, which can be by…

  9. 2.9CVE-2025-7099EPSS 0.5%

    A vulnerability has been found in BoyunCMS up to 1.21 on PHP7 and classified as critical. Affected by this vulnerability is an unknown functionality of the file install/install2.php of the component Installation Handler. The manipulation o…

  10. 1.2CVE-2025-7060EPSS 0.5%

    A vulnerability was found in Monitorr up to 1.7.6m. It has been classified as problematic. This affects an unknown part of the file assets/config/_installation/mkdbajax.php of the component Installer. The manipulation of the argument datad…

  11. 6.5CVE-2025-53502EPSS 0.2%

    Improper Input Validation vulnerability in Wikimedia Foundation Mediawiki - FeaturedFeeds Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - FeaturedFeeds Extension: 1.39.X, 1.42.X, 1.43.X.

  12. 4.8CVE-2025-6563ExploitEPSS 0.7%

    A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attacker can inject the `javascript` protocol in the `dst` parameter. When the victim browses to the malicious URL and logs …

  13. 6.5CVE-2025-52891EPSS 0.4%

    ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or Only…

  14. 9.3CVE-2025-34072EPSS 0.4%

    A data exfiltration vulnerability exists in Anthropic’s deprecated Slack Model Context Protocol (MCP) Server via automatic link unfurling. When an AI agent using the Slack MCP Server processes untrusted data, it can be manipulated to gener…

  15. 6.5CVE-2025-27023EPSS 0.5%

    Lack or insufficent input validation in WebGUI CLI web in Infinera G42 version R6.1.3 allows remote authenticated users to read all OS files via crafted CLI commands. Details: The web interface based management of the Infinera G42 appl…

  16. 10.0CVE-2025-34060EPSS 0.8%

    A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image/ endpoint. The application passes a user-supplied link parameter directly to fi…

  17. 9.4CVE-2025-34056EPSS 1.8%

    An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the PwdGrp.cgi endpoint, which handles user and group management operations. Authenticated users can supply input through the pwd or grp parameters,…

  18. 9.4CVE-2025-34055EPSS 1.5%

    An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the adcommand.cgi endpoint, which interfaces with the ActionD daemon. Authenticated users can invoke the DoShellCmd operation, passing arbitrary …

  19. 5.1CVE-2025-53076EPSS 0.4%

    Improper Input Validation vulnerability in Samsung Open Source rLottie allows Overread Buffers.This issue affects rLottie: V0.2.

  20. 4.6CVE-2025-53075EPSS 0.3%

    Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie: V0.2.

  21. 5.5CVE-2025-5878EPSS 0.5%

    A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic. This issue affects the interface Encoder.encodeForSQL of the SQL Injection Defense. An attack leads to an improper neutralization of special elements. The …

  22. 6.5CVE-2023-28911EPSS 0.4%

    A specific flaw exists within the Bluetooth stack of the MIB3 infotainment. The issue results from the lack of proper validation of user-supplied data, which can result in an arbitrary channel disconnection. An attacker can leverage this v…

  23. 8.7CVE-2025-34047EPSS 0.5%

    A path traversal vulnerability exists in the Leadsec SSL VPN (formerly Lenovo NetGuard), allowing unauthenticated attackers to read arbitrary files on the underlying system via the ostype parameter in the /vpn/user/download/client endpoint…

  24. 10.0CVE-2025-34043EPSS 7.5%

    A remote command injection vulnerability exists in Vacron Network Video Recorder (NVR) devices v1.4 due to improper input sanitization in the board.cgi script. The vulnerability allows unauthenticated attackers to pass arbitrary commands t…

  25. 7.5CVE-2025-6709EPSS 0.5%

    The MongoDB Server is susceptible to a denial of service vulnerability due to improper handling of specific date values in JSON input when using OIDC authentication. This can be reproduced using the mongo shell to send a malicious JSON pay…

  26. 2.3CVE-2025-6703EPSS 0.2%

    Improper Input Validation vulnerability in Mozilla neqo leads to an unexploitable crash..This issue affects neqo: from 0.4.24 through 0.13.2.

  27. 5.9CVE-2025-6444EPSS 0.5%

    ServiceStack GetErrorResponse Improper Input Validation NTLM Relay Vulnerability. This vulnerability allows remote attackers to relay NTLM credentials on affected installations of ServiceStack. Interaction with this library is required to …

  28. 6.9CVE-2025-52894EPSS 0.4%

    OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 allowed an attacker to perform unauthenticated, unaudited cancellation of root r…

  29. 6.6CVE-2025-52569EPSS 0.5%

    GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 5.9.1 lack input validation of input validation for user-provided values in certain functions. In the `GitHub.repo()` function, the user can provide an…

  30. 6.6CVE-2025-50178EPSS 0.5%

    GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 0.4.3 lack input validation for user provided values in certain functions. In the `GitForge.get_repo` function for GitHub, the user can provide any str…

  31. 8.8CVE-2025-52568EPSS 0.5%

    NeKernal is a free and open-source operating system stack. Prior to version 0.0.3, there are several memory safety issues that can lead to memory corruption, disk image corruption, denial of service, and potential code execution. These iss…

  32. 9.1CVE-2025-6547EPSS 0.5%

    Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: <=3.1.2.

  33. 9.1CVE-2025-6545EPSS 0.4%

    Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js. This issue affects pbkdf2: from 3.0.10 through 3.1.2.

  34. 2.7CVE-2025-4563EPSS 0.8%

    A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resou…

  35. 7.8CVE-2025-34021EPSS 0.6%

    A server-side request forgery (SSRF) vulnerability exists in multiple Selea Targa IP OCR-ANPR camera models, including iZero, Targa 512, Targa 504, Targa Semplice, Targa 704 TKM, Targa 805, Targa 710 INOX, Targa 750, and Targa 704 ILB. The…

  36. 2.0CVE-2025-6279EPSS 0.5%

    A vulnerability, which was classified as critical, has been found in Upsonic up to 0.55.6. This issue affects the function cloudpickle.loads of the file /tools/add_tool of the component Pickle Handler. The manipulation leads to deserializa…

  37. 7.1CVE-2025-29646EPSS 0.3%

    An issue in upf in open5gs 2.7.2 and earlier allows a remote attacker to cause a Denial of Service via a crafted PFCP SessionEstablishmentRequest packet with restoration indication = true and (teid = 0 or teid >= ogs_pfcp_pdr_teid_pool.siz…

  38. 5.0CVE-2025-6240EPSS 0.3%

    Improper Input Validation vulnerability in Profisee on Windows (filesystem modules) allows Path Traversal after authentication to the Profisee system.This issue affects Profisee: from 2020R1 before 2024R2.

  39. 2.7CVE-2025-1088EPSS 0.5%

    In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 a…

  40. 6.9CVE-2025-49081EPSS 0.5%

    There is an insufficient input validation vulnerability in the warehouse component of Absolute Secure Access prior to server version 13.55. Attackers with system administrator permissions can impair the availability of the Secure Access ad…

  41. 6.7CVE-2024-55567EPSS 0.2%

    Improper input validation was discovered in UsbCoreDxe in Insyde InsydeH2O kernel 5.4 before 05.47.01, 5.5 before 05.55.01, 5.6 before 05.62.01, and 5.7 before 05.71.01. The SMM module has an SMM call out vulnerability which can be used to…

  42. 7.1CVE-2025-4613EPSS 0.6%

    Path traversal in Google Web Designer's template handling versions prior to 16.3.0.0407 on Windows allows attacker to achieve remote code execution by tricking users into downloading a malicious ad template

  43. 9.5CVE-2024-1244EPSS 0.3%

    Improper input validation in the OSSEC HIDS agent for Windows prior to version 3.8.0 allows an attacker in with control over the OSSEC server or in possession of the agent's key to configure the agent to connect to a malicious UNC path. Th…

  44. 9.5CVE-2024-1243EPSS 0.6%

    Improper input validation in the Wazuh agent for Windows prior to version 4.8.0 allows an attacker with control over the Wazuh server or agent key to configure the agent to connect to a malicious UNC path. This results in the leakage of th…

  45. 3.5CVE-2025-47096EPSS 0.4%

    Adobe Experience Manager versions 6.5.22 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass, allowing a low impact to the integrity of the component. Exploitation of this i…

  46. 8.3CVE-2025-0052EPSS 0.3%

    Improper input validation performed during the authentication process of FlashBlade could lead to a system Denial of Service.

  47. 8.7CVE-2025-0051EPSS 0.4%

    Improper input validation performed during the authentication process of FlashArray could lead to a system Denial of Service.

  48. 7.8CVE-2025-47968EPSS 0.4%

    Improper input validation in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally.

  49. 6.7CVE-2025-47171ExploitEPSS 1.7%

    Improper input validation in Microsoft Office Outlook allows an authorized attacker to execute code locally.

  50. 8.6CVE-2025-4680EPSS 0.2%

    Improper Input Validation vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects upKeeper Instant Privilege Access: before 1.4.0.