[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsi-10":3},{"item":4,"lessons":18,"controls":69,"related":100},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","si-10","SI-10","Information Input Validation",229,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Systems must check the validity of defined information inputs, such as syntax and content, to prevent malformed or malicious input from causing harm.\n\n**In practice.** Doing this well means validating input on the server side against allowlists of expected formats, lengths and types, using parameterised queries, and encoding output appropriately. Secure coding standards and developer training should make these patterns the default, with static and dynamic testing to confirm them. Auditors look for coding standards, test results and remediation of injection findings. The OWASP Top 10 and ASVS describe this area in depth.\n\n**Common gaps.** Relying on client-side validation alone, inconsistent validation across APIs and internal services assumed to be trusted are common gaps. Legacy applications frequently remain vulnerable to injection.","Check the validity of the following information inputs: [Assignment: organization-defined information inputs].\nDiscussion: Checking the valid syntax and semantics of system inputs—including character set, length, numerical range, and acceptable values—verifies that inputs match specified definitions for format and content. For example, if the organization specifies that numerical values between 1-100 are the only acceptable inputs for a field in a given application, inputs of \"387,\" \"abc,\" or \"%K%\" are invalid inputs and are not accepted as input to the system. Valid inputs are likely to vary from field to field within a software application. Applications typically follow well-defined protocols that use structured messages (i.e., commands or queries) to communicate between software modules or system components. Structured messages can contain raw or unstructured data interspersed with metadata or control information. If software applications use attacker-supplied inputs to construct structured messages without properly encoding such messages, then the attacker could insert malicious commands or special characters that can cause the data to be interpreted as control information or metadata. Consequently, the module or component that receives the corrupted output will perform the wrong operations or otherwise interpret the data incorrectly. Prescreening inputs prior to passing them to interpreters prevents the content from being unintentionally interpreted as commands. Input validation ensures accurate and correct inputs and prevents attacks such as cross-site scripting and a variety of injection attacks.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":19,"list":20},228,[21,25,29,33,37,41,45,49,53,57,61,65],{"slug":22,"title":23,"published_at":24},"langflow-rce-flaw-actively-exploited-via-unvalidated-command-injection","Langflow RCE Flaw Actively Exploited via Unvalidated Command Injection","2026-10-15T10:21:22.699+00:00",{"slug":26,"title":27,"published_at":28},"maximum-severity-sap-oauth2-ssrf-flaw-enables-unauthenticated-credential-theft","Maximum-Severity SAP OAuth2 SSRF Flaw Enables Unauthenticated Credential Theft","2026-10-13T14:20:19.556+00:00",{"slug":30,"title":31,"published_at":32},"anthropic-ai-models-exploit-government-sites-during-testing","Anthropic AI Models Exploit Government Sites During Testing","2026-10-12T20:20:33.279+00:00",{"slug":34,"title":35,"published_at":36},"ai-agents-are-the-new-bec-target-social-engineering-evolves","AI Agents Are the New BEC Target: Social Engineering Evolves","2026-10-09T14:20:26.055+00:00",{"slug":38,"title":39,"published_at":40},"multiple-vulnerabilities-in-satel-netco-design-threaten-critical-infrastructure","Multiple Vulnerabilities in Satel Netco Design Threaten Critical Infrastructure","2026-10-08T18:21:44.516+00:00",{"slug":42,"title":43,"published_at":44},"critical-cisco-nx-os-flaws-enable-root-level-switch-takeover","Critical Cisco NX-OS Flaws Enable Root-Level Switch Takeover","2026-10-08T16:20:53.866+00:00",{"slug":46,"title":47,"published_at":48},"smart-contract-flaws-let-hacker-drain-53m-from-uranium-finance-twice","Smart Contract Flaws Let Hacker Drain $53M from Uranium Finance Twice","2026-10-08T14:20:40.845+00:00",{"slug":50,"title":51,"published_at":52},"unauthorized-portal-access-exposes-400000-utility-customer-records","Unauthorized Portal Access Exposes 400,000 Utility Customer Records","2026-10-07T16:21:13.362+00:00",{"slug":54,"title":55,"published_at":56},"critical-buffer-overflow-in-lwip-smtp-client-threatens-critical-infrastructure","Critical Buffer Overflow in lwIP SMTP Client Threatens Critical Infrastructure","2026-10-06T19:20:21.791+00:00",{"slug":58,"title":59,"published_at":60},"third-party-access-exploited-to-breach-denmarks-entire-population-registry","Third-Party Access Exploited to Breach Denmark's Entire Population Registry","2026-10-05T16:20:37.656+00:00",{"slug":62,"title":63,"published_at":64},"malicious-email-can-hijack-ai-agents-and-steal-connected-account-access","Malicious Email Can Hijack AI Agents and Steal Connected Account Access","2026-10-02T12:20:51.011+00:00",{"slug":66,"title":67,"published_at":68},"ai-agents-probe-government-sites-with-sql-injection-attacks","AI Agents Probe Government Sites with SQL Injection Attacks","2026-10-02T10:21:06.523+00:00",[70,75,80,85,90,95],{"slug":71,"name":72,"problem":73,"stories":74},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",99,{"slug":76,"name":77,"problem":78,"stories":79},"patch-management","Automated patch management","Known holes get closed in days, not months.",78,{"slug":81,"name":82,"problem":83,"stories":84},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",66,{"slug":86,"name":87,"problem":88,"stories":89},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",65,{"slug":91,"name":92,"problem":93,"stories":94},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",31,{"slug":96,"name":97,"problem":98,"stories":99},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",29,[101,107,112,118,124,129,133,137],{"family":102,"item":103,"code":104,"title":105,"together":106},"cis","7","Control 7","Continuous Vulnerability Management",118,{"family":108,"item":108,"code":109,"title":110,"together":111},"owasp","OWASP","OWASP (Open Worldwide Application Security Project)",101,{"family":113,"item":114,"code":115,"title":116,"together":117},"gdpr","32","Article 32","Security of processing",95,{"family":119,"item":120,"code":121,"title":122,"together":123},"nist-ai-rmf","overview","AI RMF 1.0","AI Risk Management Framework (AI RMF 1.0)",82,{"family":102,"item":125,"code":126,"title":127,"together":128},"16","Control 16","Application Software Security",80,{"family":130,"item":120,"code":131,"title":131,"together":132},"itil","ITIL",76,{"family":102,"item":134,"code":135,"title":136,"together":89},"3","Control 3","Data Protection",{"family":5,"item":138,"code":139,"title":140,"together":141},"ac-3","AC-3","Access Enforcement",61]