cve.bz

CWE-20: Improper Input Validation, page 53

Filter

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

What the weakness is: CWE-20 at MITRE

Ask an AI about CWE-20

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-20: Improper Input Validation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/20.html and https://cve.bz/cve/cwe/20?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2025-24514ExploitEPSS 37%

    A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context…

  2. 4.8CVE-2025-24513EPSS 3.3%

    A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal with…

  3. 8.8CVE-2025-1098ExploitEPSS 86%

    A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbit…

  4. 8.8CVE-2025-1097ExploitEPSS 37%

    A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in th…

  5. 4.4CVE-2025-23204EPSS 0.3%

    API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Starting in version 3.3.8, a security check that gets called after GraphQl resolvers is always replaced by another one as there's no break in a clause. As thi…

  6. 5.3CVE-2025-2690EPSS 0.7%

    A vulnerability, which was classified as critical, was found in yiisoft Yii2 up to 2.0.39. This affects the function Generate of the file phpunit\src\Framework\MockObject\MockClass.php. The manipulation leads to deserialization. It is poss…

  7. 5.3CVE-2025-2689EPSS 0.6%

    A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45. Affected by this issue is the function getIterator of the file symfony\finder\Iterator\SortableIterator.php. The manipulation leads to deserial…

  8. 5.3CVE-2025-2622EPSS 0.7%

    A vulnerability was found in aizuda snail-job 1.4.0. It has been classified as critical. Affected is the function getRuntime of the file /snail-job/workflow/check-node-expression of the component Workflow-Task Management Module. The manipu…

  9. 5.3CVE-2024-13666EPSS 0.3%

    The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 5.2.12 due to insufficient IP address validation and…

  10. 8.8CVE-2025-29814EPSS 2.3%

    Improper authorization in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network.

  11. 3.7CVE-2025-29923EPSS 0.8%

    go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.2, go-redis potentially responds out of order when `CLIENT SETINFO` times out during connection establishment. This can happen wh…

  12. 7.5CVE-2025-1385EPSS 0.5%

    When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined w…

  13. 6.9CVE-2025-2376EPSS 0.5%

    A vulnerability has been found in viames Pair Framework up to 1.9.11 and classified as critical. Affected by this vulnerability is the function getCookieContent of the file /src/UserRemember.php of the component PHP Object Handler. The man…

  14. 6.5CVE-2025-1767EPSS 0.7%

    This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-tree gitRepo volume feature has been deprecated and will not receive security up…

  15. 5.9CVE-2024-9042EPSS 1.4%

    This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below.

  16. 8.7CVE-2024-26290EPSS 0.5%

    Improper Input Validation vulnerability in Avid Avid NEXIS E-series on Linux, Avid Avid NEXIS F-series on Linux, Avid Avid NEXIS PRO+ on Linux, Avid System Director Appliance (SDA+) on Linux allows code execution on underlying operating sy…

  17. 8.6CVE-2025-20146EPSS 0.5%

    A vulnerability in the Layer 3 multicast feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers, ASR 9902 Compact High-Performance Routers, and ASR 9903 Compact High-Performance Routers could allow an unaut…

  18. 8.6CVE-2025-20142EPSS 0.5%

    A vulnerability in the IPv4 access control list (ACL) feature and quality of service (QoS) policy feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers, ASR 9902 Compact High-Performance Routers, and ASR 9…

  19. 9.4CVE-2025-27494EPSS 0.5%

    A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V6.4.9). Affected devices improperly sanitize input for the pubkey endpoint of the REST API. This co…

  20. 9.3CVE-2025-27493EPSS 0.2%

    A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V6.4.9). Affected devices improperly sanitize user input for specific commands on the telnet command…

  21. 7.5CVE-2025-26702EPSS 0.4%

    Improper Input Validation vulnerability in ZTE GoldenDB allows Input Data Manipulation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.04.

  22. 4.8CVE-2025-0660EPSS 0.3%

    Concrete CMS versions 9.0.0 through 9.3.9 are affected by a stored XSS in Folder Function.The "Add Folder" functionality lacks input sanitization, allowing a rogue admin to inject XSS payloads as folder names.  The Concrete CMS security te…

  23. 5.1CVE-2025-2043EPSS 0.5%

    A vulnerability was found in LinZhaoguan pb-cms 1.0.0 and classified as critical. This issue affects some unknown processing of the file /admin#themes of the component Add New Topic Handler. The manipulation of the argument Topic Key leads…

  24. 6.3CVE-2024-38311EPSS 0.9%

    Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 9.2.…

  25. 9.3CVE-2025-27517EPSS 0.6%

    Volt is an elegantly crafted functional API for Livewire. Malicious, user-crafted request payloads could potentially lead to remote code execution within Volt components. This vulnerability is fixed in 1.7.0.

  26. 7.2CVE-2025-1080EPSS 0.3%

    LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice a lin…

  27. 6.3CVE-2025-0958EPSS 0.4%

    The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 4.2.9. This makes it possible for authenticated attackers, with Contributor-level access…

  28. 5.5CVE-2024-58044EPSS 0.1%

    Permission verification bypass vulnerability in the notification module Impact: Successful exploitation of this vulnerability may affect availability.

  29. 7.8CVE-2024-53031EPSS 0.1%

    Memory corruption while reading a type value from a buffer controlled by the Guest Virtual Machine.

  30. 7.8CVE-2024-53030EPSS 0.1%

    Memory corruption while processing input message passed from FE driver.

  31. 8.8CVE-2024-53029EPSS 0.1%

    Memory corruption while reading a value from a buffer controlled by the Guest Virtual Machine.

  32. 7.8CVE-2024-53022EPSS 0.1%

    Memory corruption may occur during communication between primary and guest VM.

  33. 7.8CVE-2024-53012EPSS 0.1%

    Memory corruption may occur due to improper input validation in clock device.

  34. 6.5CVE-2025-0764EPSS 0.4%

    The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'update' method of the 'Members' class in all versions up to, and including, 2.4.1. This makes it possible for authentic…

  35. 9.8CVE-2024-36047EPSS 0.4%

    Infoblox NIOS through 8.6.4 and 9.x through 9.0.3 has Improper Input Validation.

  36. 5.1CVE-2025-1741EPSS 0.4%

    A vulnerability classified as problematic was found in b1gMail up to 7.4.1-pl1. Affected by this vulnerability is an unknown functionality of the file src/admin/users.php of the component Admin Page. The manipulation of the argument query/…

  37. 7.2CVE-2025-0514EPSS 0.3%

    Improper Input Validation vulnerability in The Document Foundation LibreOffice allows Windows Executable hyperlink targets to be executed unconditionally on activation.This issue affects LibreOffice: from 24.8 before < 24.8.5.

  38. 5.1CVE-2025-1556EPSS 0.7%

    A vulnerability, which was classified as problematic, has been found in westboy CicadasCMS 1.0. This issue affects some unknown processing of the file /system of the component Template Management. The manipulation leads to deserialization.…

  39. 5.3CVE-2024-13798EPSS 0.3%

    The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 2.3.5. This is due to insufficient verification on form fields. This makes it possible…

  40. 3.8CVE-2024-4028EPSS 0.3%

    A vulnerability was found in Keycloak. This issue may allow a privileged attacker to use a malicious payload as the permission while creating items (Resource and Permissions) from the admin console, leading to a stored cross-site scripting…

  41. 6.5CVE-2024-13691EPSS 0.4%

    The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncode_recordMedia' function in all versions up to, and including, 2.9.1.6. This makes it possible for authenticated attackers…

  42. 7.5CVE-2024-13681EPSS 0.6%

    The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncode_admin_get_oembed' function in all versions up to, and including, 2.9.1.6. This makes it possible for unauthenticated at…

  43. 5.1CVE-2025-0424EPSS 0.4%

    In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple authenticated stored cross-site scripting vulnerabilities. An authenticated attacker is able to compromise the sessions of other user…

  44. 5.3CVE-2025-0423EPSS 0.5%

    In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple unauthenticated stored cross-site scripting vulnerabilities. An unauthenticated attacker is able to compromise the sessions of users …

  45. 8.6CVE-2025-0422EPSS 0.9%

    An authenticated user in the "bestinformed Web" application can execute commands on the underlying server running the application. (Remote Code Execution) For this, the user must be able to create "ScriptVars" with the type „script" and pr…

  46. 5.1CVE-2025-0178EPSS 0.2%

    An Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker with network access to manipulate the value of the HTTP Host header in requests sent to the Web UI. An attacker could exploit this vulnerability to red…

  47. 7.1CVE-2025-0816EPSS 0.2%

    CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious IPV6 packets are sent to the device.

  48. 7.1CVE-2025-0815EPSS 0.2%

    CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious ICMPV6 packets are sent to the device.

  49. 6.9CVE-2025-0814EPSS 0.4%

    CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the network services running on the product when malicious IEC61850-MMS packets are sent to the device. The core functionality of the breaker rema…

  50. 6.8CVE-2024-10083EPSS 0.2%

    CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of engineering workstation when specific driver interface is invoked locally by an authenticated user with crafted input.