地图 / 输入校验不当

输入校验不当

Improper Input Validation · 其他弱点

其他弱点 / 输入校验不当

76公开报告

—CWE 编号

0已标注发现方式

76关联报告

发现方式分布

暂无发现方式标注。

关联报告

Steal ALL collateral during liquidation by exploiting lack of validation in `flip.kick`BlockDev Sp. Z o.o · 2019-10-01 · 高危 · 466 票 Bypass of GitLab CI runner slash fix in YAML validationGitLab · 2019-04-10 · 高危 · 363 票 Bypass "No Links" Restriction in Biography via Protocol-Relative URL (//)Mozilla · 2025-07-29 · 低危 · 98 票 HTML Injection on tiktoktutorials via firstName parameterTikTok · 2021-10-30 · 低危 · 97 票 Bypass of Restricted Keyword "Mozilla" in Display Name Field via Unicode Homoglyphs on addons.allizom.orgMozilla · 2026-04-27 · 低危 · $500 · 93 票 moderate: Apache HTTP Server: mod_rewrite proxy handler substitution (CVE-2024-39573) CWE-20 Improper Input ValidationInternet Bug Bounty · 2024-08-12 · 低危 · $2,600 · 89 票 Deadlock in x86 HVM standard VGA handlingInternet Bug Bounty · 2025-03-07 · 低危 · $2,162 · 88 票 Improper UUID validation results in bypass of #419896HackerOne · 2018-10-25 · 中危 · 82 票 ImageId Format Injection in Image Upload EndpointLichess · 2025-06-06 · 低危 · 73 票 jitsi-meet: Prosody/Jigasi missing header whitelist in mod_filter_iq_rayo allows arbitrary SIP header injection and Caller ID spoofing8x8 · 2026-07-02 · 低危 · $100 · 72 票 Residual Malicious Payloads on HackerOne after Vulnerability FixesHackerOne · 2026-04-16 · 低危 · 72 票 [API] ICQ user's avatar can be manipulated remotelyMail.ru · — · 未评级 · $1,000 · 70 票 Incorrect Deep-link validation leading to unresponsive application and deviceFlickr · 2024-07-06 · 低危 · 64 票 HTTP/3 Stream Dependency Cycle Exploitcurl · 2025-05-04 · 中危 · 60 票 [Source Engine] Material path truncation leads to Remote Code ExecutionValve · 2021-05-06 · 中危 · $2,500 · 60 票 HTML injection at face.city-mobil.ruMail.ru · — · 未评级 · $500 · 57 票 Html injection in event DescriptionLinkedIn · 2024-01-29 · 低危 · 55 票 CVE-2020-8177: curl overwrite local file with -Jcurl · 2020-12-05 · 低危 · 55 票 Steal all MKR from `flap` during liquidation by exploiting lack of validation in `flap.kick`BlockDev Sp. Z o.o · 2019-09-26 · 中危 · 55 票 important: Apache HTTP Server weakness with encoded question marks in backreferences (CVE-2024-38474)Internet Bug Bounty · 2024-07-13 · 中危 · $4,920 · 51 票 Posts sent via websockets aren't sanitized properlyMattermost · 2024-10-01 · 低危 · $150 · 40 票 CSS Injection to disable app & potential message exfilSlack · 2019-11-09 · 低危 · 37 票 MQTT state machine confusion: PINGRESP/DISCONNECT with non-zero remaining_length dispatches to stale nextstatecurl · 2026-04-29 · 低危 · 36 票 Improper input validation in projects leads to fully deny access to project resourcesSemrush · 2021-09-01 · 低危 · 35 票 Bypass parsing of transaction data, users on the phishing site will transfer/approve ERC20 tokens without being alertedMetaMask · 2023-04-10 · 低危 · $1,000 · 32 票 athome.starbucks.com - URL parameter tampering of review forms permitted possible content injectionStarbucks · 2020-03-17 · 低危 · 31 票 important: Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. (CVE-2024-38475)Internet Bug Bounty · 2024-07-13 · 中危 · $4,920 · 30 票 Add more seats by paying less via PUT /v2/seats request manipulationKrisp · 2022-06-20 · 低危 · 30 票 HTTP/2 server push accepts a non-authoritative :scheme=https over cleartext h2c, enabling HTTPS cache-key poisoningcurl · 2026-03-29 · 中危 · 26 票 Local File Inclusion in download.phpU.S. Dept Of Defense · 2024-07-19 · 低危 · 25 票 Operation CreateOrUpdateSo5LineupMutation does not restrict multiple captainsSorare · 2023-08-01 · 低危 · $300 · 23 票 Inconsistent URL Parsing in curl Leading to Potential SSRF and Access Control Bypasscurl · 2025-09-26 · 低危 · 22 票 CVE-2023-28710 Apache Airflow Spark Provider Arbitrary File Read via JDBCInternet Bug Bounty · 2023-07-12 · 低危 · $2,400 · 22 票 Functional Regression in Digest Authentication: Failure to handle optional spaces and escaped quotescurl · 2025-12-21 · 低危 · 20 票 Bypass global deny-lists by wrapping domains using "[]" in https://github.com/stripe/smokescreenStripe · 2022-05-18 · 低危 · 20 票 Hyper Link Injection while signupUPchieve · 2022-06-15 · 低危 · 20 票 Moderators can send messages to users from banned subreddits via `oauth.reddit.com/api/mod/conversations`Reddit · 2022-07-04 · 低危 · $100 · 19 票 Cookie attribute TAB injection regression in Set-Cookie parsingcurl · 2026-04-03 · 低危 · 18 票 Insecure OAuth redirection at [admin.8x8.vc]8x8 · 2020-04-10 · 中危 · 18 票 [pandao.ru] possibility to attach arbitrary phone number to account registered via social networkMail.ru · — · 未评级 · $750 · 18 票 libcurl RTSP `CURLOPT_CRLF` conversion allows a request body to become a second RTSP requestcurl · 2026-10-17 · 低危 · 16 票 moderate: Apache HTTP Server proxy encoding problem (CVE-2024-38473)Internet Bug Bounty · 2024-07-13 · 低危 · $2,600 · 16 票 Improper user validation on mentions and hashtagsTikTok · 2023-06-22 · 低危 · 16 票 Unsafe Global IFS Modification in OS400 Shell Script Enables Command Injection and Parsing Flaws (CWE-78/CWE-20)curl · 2025-08-12 · 中危 · 15 票 Improper Input Validation on User's Location on PUT /WhoService/putLocation Could Affect Availability/Falsify UsersWHO COVID-19 Mobile App · 2020-12-22 · 低危 · 15 票 IMAP Protocol Desynchronization and Response Smuggling via Naive Literal Parsingcurl · 2026-01-14 · 低危 · 14 票 2FA Disable With Wrong Password - Response Tampering.8x8 · 2020-10-21 · 中危 · 14 票 Improper Input Validation on payment pageGenasys Technologies · — · 未评级 · 14 票 CVE-2022-35252: control code in cookie denial of servicecurl · 2022-08-31 · 低危 · 13 票 Remote code execution due to unvalidated file uploadMTN Group · 2022-09-01 · 高危 · 12 票 Economic Harm through Twitter's Cropping AlgorithmTwitter Algorithmic Bias · 2021-09-08 · 高危 · 11 票 HTTP header values do not have trailing OWS trimmedNode.js · 2020-02-24 · 中危 · 11 票 H1514 Shopify API ruby SDK session setup lacks input validation, resulting in SSRF and leakage of client secretShopify · 2019-04-05 · 低危 · 11 票 Add non-existent room moderatorChaturbate · 2018-10-19 · 低危 · 11 票 Logical Flaw in curl_url_set Leads to Inconsistent Query Parameter Encodingcurl · 2025-10-29 · 低危 · 10 票 Underrepresentation Bias through Twitter's Cropping AlgorithmTwitter Algorithmic Bias · 2021-09-08 · 高危 · 10 票 SMB access smuggling via FILE URL on Windowscurl · 2021-01-17 · 低危 · 10 票 Send Phishing/Spam email from [email protected] to any email address.8x8 · 2020-08-05 · 中危 · 9 票 Arbitrary File Deletion Vulnerability in curl Source Code via os.unlink()curl · 2025-07-07 · 中危 · 8 票 CVE-2023-25692: Apache Airflow Google Provider: Google Cloud Sql Provider Denial Of Service and Remote Command ExecutionInternet Bug Bounty · 2023-04-16 · 低危 · $480 · 8 票 CVE-2022-35252: control code in cookie denial of serviceInternet Bug Bounty · 2022-11-05 · 低危 · 8 票 CVE-2022-27780: percent-encoded path separator in URL hostInternet Bug Bounty · 2022-06-11 · 低危 · 8 票 Improper Input Validation on User's Location on PUT /WhoService/putLocation Could Affect Availability/Falsify UsersWHO COVID-19 Mobile App · 2021-01-12 · 低危 · 8 票 Apache Airflow Google Cloud Sql Provider Remote Command ExecutionInternet Bug Bounty · 2023-04-16 · 低危 · $2,400 · 7 票 Underrepresentation Bias through Twitter's Cropping Algorithm #2: Favoring Animals over Black PeopleTwitter Algorithmic Bias · 2021-09-08 · 高危 · 6 票 Bug in OAuth Success Redirect URI ValidationPolymail, Inc. · — · 未评级 · 6 票 [url-parse] Improper Validation and SanitizationNode.js third-party modules · 2020-01-27 · 中危 · 6 票 urlapi: CURLUPART_HOST accepts text after an IPv6 zone ip and URL round trip changes the hostcurl · 2026-10-19 · 低危 · 5 票 CVE-2021-22924: Bad connection reuse due to flawed path name checkscurl · 2021-07-21 · 中危 · 5 票 Missing captcha and rate limit protection in help formMTN Group · 2021-12-11 · 低危 · 3 票 Derived cookie Path aborts cookie jar loading in curl 8.23.0curl · 2026-10-26 · 低危 · 2 票 Improper Input Validation allows an attacker to "double spend" or "respend", violating the integrity of the message command history or causing DoSAgoric · — · 未评级 · 2 票 CVE-2026-111481: server-set cookie still aborts cookie jarcurl · 2026-10-26 · 低危 · 1 票 CVE-2026-80255: secure cookie attribute bypass with tabcurl · 2026-09-03 · 未评级 · 1 票 Division by zero if terminal width is 2curl · 2021-02-08 · 未评级 · 1 票 curl still vulnerable to SMB access smuggling via FILE URL on Windowscurl · 2021-01-08 · 未评级 · 0 票