CWE-1286 Improper Validation of Syntactic Correctness of Input
baseThe product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (116)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-25513US | high8.8 | Exploit | ||
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the… | ||||
| CVE-2026-88009US | high8.2 | Exploit | ||
Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while le… | ||||
| CVE-2024-7954US | — | Exploit | ||
The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can exe… | ||||
| CVE-2026-42579US | critical9.1 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints d… | ||||
| CVE-2026-34835US | medium6.5 | Exploit | ||
Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Request parses the Host header using an AUTHORITY regular… | ||||
| CVE-2021-28812US | high8.8 | — | ||
A command injection vulnerability has been reported to affect certain versions of Video Station. If exploited, this vulnerability allows remote attackers to execute arbitrary comma… | ||||
| CVE-2020-13254US | medium5.9 | Exploit | ||
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could res… | ||||
| CVE-2026-83728US | high8.8 | — | ||
Improper validation of syntactic correctness of input in Windows Hyper-V allows an authorized attacker to perform spoofing locally. | ||||
| CVE-2021-31988US | high8.8 | — | ||
A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and Line Feed (CRLF) control characters and… | ||||
| CVE-2026-102084US | high8.1 | — | ||
An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series allows an authenticated, network-based attacker… | ||||
| CVE-2023-26049US | medium5.3 | Exploit | ||
Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform uninten… | ||||
| CVE-2022-1941US | high7.5 | — | ||
A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versi… | ||||
| CVE-2026-48059US | high7.5 | — | ||
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in n… | ||||
| CVE-2026-6918US | high7.5 | — | ||
In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message. | ||||
| CVE-2025-55085US | high7.5 | — | ||
In NextX Duo before 6.4.4, in the HTTP client module, the network support code for Eclipse Foundation ThreadX, the parsing of HTTP header fields was missing bounds verification. A… | ||||
| CVE-2025-10954US | high7.5 | — | ||
Versions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of Input in the phonenumbers.Parse() function. A… | ||||
| CVE-2024-3384US | high7.5 | — | ||
A vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to reboot PAN-OS firewalls when receiving Windows New Technology LAN Manager (NTLM) packets from Win… | ||||
| CVE-2024-21616US | high7.5 | — | ||
An Improper Validation of Syntactic Correctness of Input vulnerability in Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an unauthenticated, network-based atta… | ||||
| CVE-2024-21595US | high7.5 | — | ||
An Improper Validation of Syntactic Correctness of Input vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows a network-based, unauthenticated a… | ||||
| CVE-2023-32649US | high7.5 | — | ||
A Denial of Service (Dos) vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields used in the Asset Intelligence functionality of our… | ||||
04
attack patterns (2)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan