CWE-20: Improper Input Validation, page 52
Filter
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
What the weakness is: CWE-20 at MITRE
Ask an AI about CWE-20
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-20: Improper Input Validation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/20.html and https://cve.bz/cve/cwe/20?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.4CVE-2023-42981EPSS 0.3%
Processing a file may lead to a denial-of-service or potentially disclose memory contents. This issue is fixed in macOS 14. The issue was addressed with improved checks.
- 7.8CVE-2023-42977EPSS 0.2%
A path handling issue was addressed with improved validation. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to break out of its sandbox.
- 4.3CVE-2025-29150EPSS 0.4%
BlueCMS 1.6 suffers from Arbitrary File Deletion via the id parameter in an /publish.php?act=del request.
- 6.5CVE-2023-43037EPSS 0.3%
IBM Maximo Application Suite 8.11 and 9.0 could allow an authenticated user to perform unauthorized actions due to improper input validation.
- 8.7CVE-2025-30649EPSS 0.4%
An Improper Input Validation vulnerability in the syslog stream TCP transport of Juniper Networks Junos OS on MX240, MX480 and MX960 devices with MX-SPC3 Security Services Card allows an unauthenticated, network-based attacker, to send spe…
- 7.1CVE-2025-30648EPSS 0.2%
An Improper Input Validation vulnerability in the Juniper DHCP Daemon (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause the jdhcpd process to crash resulting in a Denial of Ser…
- 5.3CVE-2025-31672EPSS 1.4%
Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with …
- 8.4CVE-2025-2223EPSS 0.2%
CWE-20: Improper Input Validation vulnerability exists that could cause a loss of Confidentiality, Integrity and Availability of engineering workstation when a malicious project file is loaded by a user from the local system.
- 6.8CVE-2025-30294EPSS 17%
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass secu…
- 6.8CVE-2025-30293EPSS 0.9%
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass secu…
- 9.1CVE-2025-24446EPSS 1.8%
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution. Exploitation of this issue does not require user interaction, but admin pane…
- 5.5CVE-2025-29821EPSS 0.7%
Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally.
- 7.8CVE-2025-29811EPSS 0.6%
Improper input validation in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally.
- 8.6CVE-2025-27737EPSS 0.8%
Improper input validation in Windows Security Zone Mapping allows an unauthorized attacker to bypass a security feature locally.
- 7.8CVE-2025-27731EPSS 0.6%
Improper input validation in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-27489EPSS 0.6%
Improper input validation in Azure Local allows an authorized attacker to elevate privileges locally.
- 8.8CVE-2025-26647EPSS 2.3%
Improper input validation in Windows Kerberos allows an authorized attacker to elevate privileges over a network.
- 7.8CVE-2025-24074EPSS 0.6%
Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-24073EPSS 0.6%
Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-24062EPSS 0.6%
Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-24060EPSS 0.6%
Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-24058EPSS 0.6%
Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
- 7.5CVE-2025-30151EPSS 0.4%
Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresp…
- 5.3CVE-2025-3413EPSS 0.6%
A vulnerability has been found in opplus springboot-admin up to a2d5310f44fd46780a8686456cf2f9001ab8f024 and classified as critical. Affected by this vulnerability is the function code of the file SysGeneratorController.java. The manipulat…
- 5.0CVE-2025-31488EPSS 0.2%
Plain Craft Launcher (PCL) is a launcher for Minecraft. PCL allows users to use homepages provided by third parties. If controls such as WebBrowser are used in the homepage, WPF will use Internet Explorer to load the specified webpage. If …
- 5.3CVE-2025-3250EPSS 0.5%
A vulnerability, which was classified as problematic, has been found in elunez eladmin 2.7. Affected by this issue is some unknown functionality of the file /api/database/testConnect of the component Maintenance Management Module. The mani…
- 4.8CVE-2025-3165EPSS 0.2%
A vulnerability classified as critical has been found in thu-pacman chitu 0.1.0. This affects the function torch.load of the file chitu/chitu/backend.py. The manipulation of the argument ckpt_path/quant_ckpt_dir leads to deserialization. A…
- 4.8CVE-2025-3162EPSS 0.3%
A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been classified as critical. Affected is the function load_weight_ckpt of the file lmdeploy/lmdeploy/vl/model/utils.py of the component PT File Handler. The manipulation le…
- 9.3CVE-2025-31477EPSS 1.0%
The Tauri shell plugin allows access to the system shell. Prior to 2.2.1, the Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow open functionalit…
- 7.5CVE-2025-30080EPSS 0.5%
Signalling in Pexip Infinity 29 through 36.2 before 37.0 has improper input validation that allows remote attackers to trigger a temporary denial of service (software abort).
- 7.5CVE-2024-37917EPSS 0.5%
Pexip Infinity before 35.0 has improper input validation that allows remote attackers to trigger a denial of service (software abort) via a crafted signalling message.
- 9.8CVE-2024-39780EPSS 0.4%
A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parameters of a dynamically configurable node, affecting ROS distributions Noetic and ear…
- 6.5CVE-2025-3070EPSS 0.3%
Insufficient validation of untrusted input in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)
- 8.8CVE-2025-3068EPSS 0.4%
Inappropriate implementation in Intents in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)
- 5.3CVE-2025-31135EPSS 0.4%
Go-Guerrilla SMTP Daemon is a lightweight SMTP server written in Go. Prior to 1.6.7, when ProxyOn is enabled, the PROXY command will be accepted multiple times, with later invocations overriding earlier ones. The proxy protocol only suppor…
- 8.1CVE-2025-31132EPSS 0.6%
Raven is an open-source messaging platform. A vulnerability allowed any logged in user to execute code via an API endpoint. This vulnerability is fixed in 2.1.10.
- 7.5CVE-2025-30471EPSS 1.5%
A validation issue was addressed with improved logic. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. A remote user may b…
- 9.8CVE-2025-30452EPSS 1.1%
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An input validation issue was addressed.
- 8.4CVE-2025-24255EPSS 0.3%
A file access issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to break out of its sandbox.
- 5.5CVE-2025-24191EPSS 0.3%
The issue was addressed with improved validation of environment variables. This issue is fixed in macOS Sequoia 15.4. An app may be able to modify protected parts of the file system.
- 7.5CVE-2023-0881EPSS 0.4%
Running DDoS on tcp port 22 will trigger a kernel crash. This issue is introduced by the backport of a commit regarding nft_lookup without the subsequent fixes that were introduced after this commit. The resolution of this CVE introduces t…
- 6.3CVE-2025-1736EPSS 0.6%
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from b…
- 6.3CVE-2025-1734EPSS 0.5%
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. T…
- 6.3CVE-2025-1217EPSS 0.6%
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to mi…
- 5.1CVE-2025-2855EPSS 0.6%
A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is the function checkFile of the file /api/deploy/upload. The manipulation of the argument servers leads to deserializ…
- 7.5CVE-2025-30355EPSS 1.2%
Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wil…
- 4.3CVE-2025-20227EPSS 0.4%
In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208 and 9.1.2308.214, a low-privileged user that does not hold the "admin" or "…
- 5.3CVE-2025-1440EPSS 0.3%
The Advanced iFrame plugin for WordPress is vulnerable to unauthorized excessive creation of options on the aip_map_url_callback() function in all versions up to, and including, 2024.5 due to insufficient restrictions. This makes it possib…
- 7.3CVE-2025-1514EPSS 0.4%
The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to unauthorized filter calling due to insufficient restrictions on the get_smth() function in all versions up to, and including…
- 6.3CVE-2025-30213EPSS 0.7%
Frappe is a full-stack web application framework. Prior to versions 14.91.0 and 15.52.0, a system user was able to create certain documents in a specific way that could lead to remote code execution. Versions 14.9.1 and 15.52.0 contain a p…