CWE-20 · Improper Input Validation (page 20)
Page 20 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-13691 | Medium | 6.5 | 2025-02-18 | The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncode_recordMedia' function in all versions u… |
CVE-2024-13681 | High | 7.5 | 2025-02-18 | The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncode_admin_get_oembed' function in all versi… |
CVE-2025-0424 | | 2025-02-18 | In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple authenticated stored cross-site scripting vulnerabili… | |
CVE-2025-0423 | | 2025-02-18 | In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple unauthenticated stored cross-site scripting vulnerabi… | |
CVE-2025-0422 | | 2025-02-18 | An authenticated user in the "bestinformed Web" application can execute commands on the underlying server running the application. (Remote Code Execution) For… | |
CVE-2025-0178 | Medium | 6.1 | 2025-02-14 | An Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker with network access to manipulate the value of the HTTP Host header in… |
CVE-2025-0816 | Medium | 6.5 | 2025-02-13 | CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious IPV6 packets are sent to the device. |
CVE-2025-0815 | Medium | 6.5 | 2025-02-13 | CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious ICMPV6 packets are sent to the device. |
CVE-2025-0814 | Medium | 5.3 | 2025-02-13 | CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the network services running on the product when malicious IEC6185… |
CVE-2024-10083 | Medium | 5.5 | 2025-02-13 | CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of engineering workstation when specific driver interface is invoked… |
CVE-2024-42410 | Medium | 6.5 | 2025-02-12 | Improper input validation in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2024-39606 | Medium | 6.1 | 2025-02-12 | Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an unauthenticated user… |
CVE-2024-38307 | High | 7.7 | 2025-02-12 | Improper input validation in the firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow an authenticated user to potentially enable denia… |
CVE-2024-31153 | Medium | 5.0 | 2025-02-12 | Improper input validation for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authenticated user to potentially enable denial o… |
CVE-2024-29214 | High | 7.5 | 2025-02-12 | Improper input validation in UEFI firmware CseVariableStorageSmm for some Intel(R) Processors may allow a privileged user to potentially enable escalation of p… |
CVE-2024-28127 | High | 7.5 | 2025-02-12 | Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local acc… |
CVE-2024-28047 | Medium | 5.3 | 2025-02-12 | Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local acce… |
CVE-2024-25571 | Low | 2.3 | 2025-02-12 | Improper input validation in some Intel(R) SPS firmware before SPS_E5_06.01.04.059.0 may allow a privileged user to potentially enable denial of service via lo… |
CVE-2024-24582 | High | 7.5 | 2025-02-12 | Improper input validation in XmlCli feature for UEFI firmware for some Intel(R) processors may allow privileged user to potentially enable escalation of privil… |
CVE-2023-49615 | High | 7.5 | 2025-02-12 | Improper input validation in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enable escal… |
CVE-2023-43758 | High | 8.2 | 2025-02-12 | Improper input validation in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of privilege via local acc… |
CVE-2023-34440 | High | 7.5 | 2025-02-12 | Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local acc… |
CVE-2025-26358 | Medium | 5.5 | 2025-02-12 | A CWE-15 "External Control of System or Configuration Setting" in ldbMT.so in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remot… |
CVE-2025-1186 | Medium | 6.3 | 2025-02-12 | A vulnerability was found in dayrui XunRuiCMS up to 4.6.4. It has been declared as critical. This vulnerability affects unknown code of the file /Control/Api/A… |
CVE-2024-0112 | High | 7.5 | 2025-02-12 | NVIDIA Jetson AGX Orin™ and NVIDIA IGX Orin software contain a vulnerability where an attacker can cause an improper input validation issue by escalating certa… |
CVE-2024-21925 | High | 8.2 | 2025-02-11 | Improper input validation within the AmdPspP2CmboxV2 driver may allow a privileged attacker to overwrite SMRAM, leading to arbitrary code execution. |
CVE-2024-0179 | High | 8.2 | 2025-02-11 | SMM Callout vulnerability within the AmdCpmDisplayFeatureSMM driver could allow locally authenticated attackers to overwrite SMRAM, potentially resulting in ar… |
CVE-2025-21375 | High | 7.8 | 2025-02-11 | Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability |
CVE-2025-21350 | Medium | 5.9 | 2025-02-11 | Windows Kerberos Denial of Service Vulnerability |
CVE-2025-21194 | High | 7.1 | 2025-02-11 | Microsoft Surface Security Feature Bypass Vulnerability |
CVE-2025-21126 | Medium | 5.5 | 2025-02-11 | InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of… |
CVE-2024-33659 | High | 8.8 | 2025-02-11 | AMI APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation by a local attacker. Successful exploitation of these vuln… |
CVE-2025-24499 | High | 7.2 | 2025-02-11 | A vulnerability has been identified in SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) (All versions < V3.0.0), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) (All versions < V… |
CVE-2025-1177 | Medium | 6.3 | 2025-02-11 | A vulnerability was found in dayrui XunRuiCMS 4.6.3. It has been classified as critical. Affected is the function import_add of the file dayrui/Fcms/Control/Ad… |
CVE-2025-24970 | High | 7.5 | 2025-02-10 | Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. Wh… |
CVE-2024-55630 | Low | 3.3 | 2025-02-07 | Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin's HTML sanitizer all… |
CVE-2025-1113 | Medium | 6.3 | 2025-02-07 | A vulnerability was found in taisan tarzan-cms up to 1.0.0. It has been rated as critical. This issue affects the function upload of the file /admin#themes of… |
CVE-2025-1077 | | 2025-02-07 | A security vulnerability has been identified in the IBL Software Engineering Visual Weather and derived products (NAMIS, Aero Weather, Satellite Weather). The… | |
CVE-2024-57960 | High | 7.7 | 2025-02-06 | Input verification vulnerability in the ExternalStorageProvider module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-24319 | Medium | 6.5 | 2025-02-05 | When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can cause the BIG-IP Next Central Manager Node's Kuber… |
CVE-2024-56135 | High | 8.4 | 2025-02-05 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affe… |
CVE-2024-56134 | High | 8.4 | 2025-02-05 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affe… |
CVE-2024-56133 | High | 8.4 | 2025-02-05 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affe… |
CVE-2024-56132 | High | 8.4 | 2025-02-05 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affe… |
CVE-2024-56131 | High | 8.4 | 2025-02-05 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affe… |
CVE-2025-20184 | Medium | 6.5 | 2025-02-05 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Web Appliance could allow an au… |
CVE-2025-20183 | Medium | 5.8 | 2025-02-05 | A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could… |
CVE-2025-1026 | High | 8.6 | 2025-02-05 | Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method, w… |
CVE-2025-1022 | High | 8.2 | 2025-02-05 | Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), wh… |
CVE-2024-38420 | High | 8.8 | 2025-02-03 | Memory corruption while configuring a Hypervisor based input virtual device. |
CVE-2024-38413 | Medium | 6.6 | 2025-02-03 | Memory corruption while processing frame packets. |
CVE-2025-0974 | Medium | 5.0 | 2025-02-03 | A vulnerability was determined in MaxD Lightning Module 4.43/4.44 on OpenCart. This issue affects some unknown processing. Executing a manipulation of the argu… |
CVE-2025-0938 | | 2025-01-31 | The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to… | |
CVE-2024-47857 | Critical | 9.8 | 2025-01-31 | SSH Communication Security PrivX versions between 18.0-36.0 implement insufficient validation on public key signatures when using native SSH connections via a… |
CVE-2025-24504 | | 2025-01-30 | An improper input validation the CSRF filter results in unsanitized user input written to the application logs. | |
CVE-2025-24501 | | 2025-01-30 | An improper input validation allows an unauthenticated attacker to alter PAM logs by sending a specially crafted HTTP request. | |
CVE-2025-0841 | High | 7.3 | 2025-01-29 | A vulnerability has been found in Aridius XYZ up to 20240927 on OpenCart and classified as critical. This vulnerability affects the function loadMore of the co… |
CVE-2025-24882 | Medium | 5.2 | 2025-01-29 | regclient is a Docker and OCI Registry Client in Go. A malicious registry could return a different digest for a pinned manifest without detection. This vulnera… |
CVE-2025-0734 | Medium | 4.7 | 2025-01-27 | A vulnerability has been found in y_project RuoYi up to 4.8.0 and classified as critical. This vulnerability affects the function getBeanName of the component… |
CVE-2024-43445 | Medium | 5.4 | 2025-01-27 | A vulnerability exists in OTRS and ((OTRS Community Edition)) that fail to set the HTTP response header X-Content-Type-Options to nosniff. An attacker could ex… |
CVE-2024-10846 | Medium | 5.9 | 2025-01-23 | The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excess… |
CVE-2023-50733 | High | 8.6 | 2025-01-21 | A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Web Services feature of newer Lexmark devices. |
CVE-2025-23202 | | 2025-01-17 | Bible Module is a tool designed for ROBLOX developers to integrate Bible functionality into their games. The `FetchVerse` and `FetchPassage` functions in the B… | |
CVE-2025-23041 | Medium | 5.8 | 2025-01-14 | Umbraco.Forms is a web form framework written for the nuget ecosystem. Character limits configured by editors for short and long answer fields are validated on… |
CVE-2025-21370 | High | 7.8 | 2025-01-14 | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability |
CVE-2025-21344 | High | 7.8 | 2025-01-14 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2025-21284 | Medium | 5.5 | 2025-01-14 | Windows Virtual Trusted Platform Module Denial of Service Vulnerability |
CVE-2025-21280 | Medium | 5.5 | 2025-01-14 | Windows Virtual Trusted Platform Module Denial of Service Vulnerability |
CVE-2025-21235 | High | 7.8 | 2025-01-14 | Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability |
CVE-2025-21234 | High | 7.8 | 2025-01-14 | Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability |
CVE-2025-21230 | High | 7.5 | 2025-01-14 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2025-0465 | High | 7.3 | 2025-01-14 | A vulnerability was found in AquilaCMS 1.412.13. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/v2/catego… |
CVE-2024-11636 | Medium | 4.8 | 2025-01-13 | The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its Text Block options, which could allow high pr… |
CVE-2024-42175 | Low | 2.6 | 2025-01-11 | HCL MyXalytics is affected by a weak input validation vulnerability. The application accepts special characters and there is no length validation. This can le… |
CVE-2025-22137 | Critical | 9.8 | 2025-01-08 | Pingvin Share is a self-hosted file sharing platform and an alternative for WeTransfer. This vulnerability allows an authenticated or unauthenticated (if anony… |
CVE-2024-54121 | Medium | 6.2 | 2025-01-08 | Startup control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2024-56437 | Medium | 5.7 | 2025-01-08 | Vulnerability of input parameters not being verified in the widget framework module Impact: Successful exploitation of this vulnerability may affect availabili… |
CVE-2024-47934 | Medium | 5.3 | 2025-01-08 | Improper Input Validation vulnerability in Management Program in TXOne Networks Portable Inspector and Portable Inspector Pro Edition allows remote attacker to… |
CVE-2024-51741 | Medium | 4.4 | 2025-01-06 | Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when… |
CVE-2024-13136 | Medium | 6.3 | 2025-01-05 | A vulnerability was found in wangl1989 mysiteforme 1.0 and classified as critical. Affected by this issue is the function rememberMeManager of the file src/mai… |
CVE-2024-56321 | Low | 3.8 | 2025-01-03 | GoCD is a continuous deliver server. GoCD versions 18.9.0 through 24.4.0 (inclusive) can allow GoCD admins to abuse the backup configuration "post-backup scrip… |
CVE-2024-12912 | High | 7.2 | 2025-01-02 | An improper input insertion vulnerability in AiCloud on certain router models may lead to arbitrary command execution. Refer to the '01/02/2025 ASUS Router AiC… |
CVE-2024-12994 | Medium | 6.3 | 2024-12-28 | A vulnerability was found in running-elephant Datart 1.0.0-rc3. It has been rated as critical. Affected by this issue is the function extractModel of the file… |
CVE-2021-22484 | High | 7.5 | 2024-12-28 | Some Huawei wearables have a vulnerability of not verifying the actual data size when reading data. Successful exploitation of this vulnerability may cause… |
CVE-2024-12014 | | 2024-12-20 | Path Traversal vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthenticated attacker to access a… | |
CVE-2024-21549 | High | 8.6 | 2024-12-20 | Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An att… |
CVE-2022-34159 | High | 7.5 | 2024-12-20 | Huawei printers have an input verification vulnerability. Successful exploitation of this vulnerability may cause device service exceptions. (Vulnerability ID… |
CVE-2022-32204 | High | 7.5 | 2024-12-20 | There is an improper input verification vulnerability in Huawei printer product. Successful exploitation of this vulnerability may cause service abnormal. (Vul… |
CVE-2022-32144 | High | 8.6 | 2024-12-20 | There is an insufficient input verification vulnerability in Huawei product. Successful exploitation of this vulnerability may lead to service abnormal. (Vulne… |
CVE-2024-25131 | High | 8.8 | 2024-12-19 | A flaw was found in the MustGather.managed.openshift.io Custom Defined Resource (CRD) of OpenShift Dedicated. A non-privileged user on the cluster can create a… |
CVE-2024-52593 | Medium | 5.3 | 2024-12-18 | Misskey is an open source, federated social media platform.In affected versions missing validation in `NoteCreateService.insertNote`, `ApPersonService.createPe… |
CVE-2024-52592 | Medium | 5.3 | 2024-12-18 | Misskey is an open source, federated social media platform. In affected versions missing validation in `ApInboxService.update` allows an attacker to modify the… |
CVE-2024-52591 | Critical | 9.3 | 2024-12-18 | Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` and `HttpRequestService.get… |
CVE-2024-52590 | Medium | 6.5 | 2024-12-18 | Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` allows an attacker to creat… |
CVE-2024-52579 | Medium | 6.4 | 2024-12-18 | Misskey is an open source, federated social media platform. Some APIs using `HttpRequestService` do not properly check the target host. This vulnerability allo… |
CVE-2024-55952 | High | 8.8 | 2024-12-18 | DataEase is an open source business analytics tool. Authenticated users can remotely execute code through the backend JDBC connection. When constructing the jd… |
CVE-2020-12487 | High | 7.0 | 2024-12-17 | Due to the flaws in the verification of input parameters, the attacker can input carefully constructed commands to make the ABE service execute some commands w… |
CVE-2024-21544 | High | 8.6 | 2024-12-13 | Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An at… |
CVE-2024-47238 | High | 7.5 | 2024-12-12 | Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local acces… |
CVE-2024-54101 | Medium | 6.2 | 2024-12-12 | Denial of service (DoS) vulnerability in the installation module Impact: Successful exploitation of this vulnerability will affect availability. |