CWE-1287
Improper Validation of Specified Type of Input
The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
We have discovered 11,181 live websites that are affected by CWE-1287.
CVEs
- Count - 14
CWE References
Website Distribution by Country
Number of websites using CWE-1287 United States | 2,965 websites |
 GB | 1,222 websites |
 Japan | 1,163 websites |
 Germany | 1,150 websites |
 Netherlands | 606 websites |
 Switzerland | 538 websites |
 Australia | 461 websites |
 Canada | 430 websites |
 Poland | 355 websites |
 Finland | 228 websites |
Website Distribution by TLD
Number of websites using CWE-1287| .com | 3,859 websites |
| .co.uk | 791 websites |
| .de | 761 websites |
| .org | 638 websites |
| .nl | 519 websites |
| .ch | 518 websites |
| .com.au | 377 websites |
| .jp | 323 websites |
| .net | 297 websites |
| .ca | 247 websites |
Newest CVEs
List of the most recent CVEs that are part of CWE-1287| Discovered | CVE | Description | Websites |
|---|---|---|---|
| May, 2026 | CVE-2026-4646 | Insufficient input validation in GitHub plugin API causes denial of service | 118 |
| May, 2026 | CVE-2026-7887 | For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status | 10,952 |
| Mar, 2026 | CVE-2026-2454 | DoS in Calls plugin via malformed msgpack in websocket request. | 76 |
| Mar, 2026 | CVE-2026-25783 | Denial of service via malformed User-Agent header in getBrowserVersion | 76 |
| Dec, 2025 | CVE-2025-12689 | DoS in Calls plugin via malformed UTF-8 in WebSocket request | 41 |
| Dec, 2025 | CVE-2025-13352 | Mattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijacking | 24 |
| Oct, 2025 | CVE-2025-58084 | Mattermost Desktop App crashes when clicking on malformed external URL | 16 |
| Aug, 2025 | CVE-2025-8402 | Nil pointer dereference in bulk import crashes server | 34 |
| Apr, 2025 | CVE-2025-41395 | Webapp DoS via malicious retrospective post in Playbooks | 14 |
| Jan, 2025 | CVE-2025-20621 | Webapp crash via object that can't be cast to String in Attachment Field | 10 |
The most widespread CVEs
List of the most common CVEs that are part of CWE-1287| Discovered | CVE | Description | Websites |
|---|---|---|---|
| May, 2026 | CVE-2026-7887 | For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status | 10,952 |
| May, 2026 | CVE-2026-4646 | Insufficient input validation in GitHub plugin API causes denial of service | 118 |
| Mar, 2026 | CVE-2026-2454 | DoS in Calls plugin via malformed msgpack in websocket request. | 76 |
| Mar, 2026 | CVE-2026-25783 | Denial of service via malformed User-Agent header in getBrowserVersion | 76 |
| Dec, 2025 | CVE-2025-12689 | DoS in Calls plugin via malformed UTF-8 in WebSocket request | 41 |
| Aug, 2025 | CVE-2025-8402 | Nil pointer dereference in bulk import crashes server | 34 |
| Dec, 2025 | CVE-2025-13352 | Mattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijacking | 24 |
| Dec, 2024 | CVE-2024-54083 | DoS via lack of type validation in Calls | 17 |
| Oct, 2025 | CVE-2025-58084 | Mattermost Desktop App crashes when clicking on malformed external URL | 16 |
| Apr, 2025 | CVE-2025-41395 | Webapp DoS via malicious retrospective post in Playbooks | 14 |
Websites affected by CWE-1287
Top websites that are affected by CWE-1287. Please click on the "Contact us" link to get more information.| Domain | Country | Rank | Contacts |
|---|---|---|---|
| *************.com | United States | **,*** | |
| ****************.org | United States | **,*** | |
| *****.**.jp | Japan | **,*** | |
| **.*********.jp | Japan | **,*** | |
| ***.****.*****.**.us | United States | **,*** | |
| ******.*******.edu | United States | ***,*** | |
| ***.*********.jp | Japan | ***,*** | |
| *************.org | United States | ***,*** | |
| ****.*******.edu | United States | ***,*** | |
| *************************************************.***.au | Australia | ***,*** |