Node validation ingnores missing inputs

Node validation is fairly uniform throughout Drupal. Modules implement hook_validate, check the inputs, and use form_set_error if the inputs are invalid.

A typical example from node.module's node_validate($node):
...
// Validate the title field.
if (isset($node->title)) {
$node->title = strip_tags($node->title);
if (!$node->title) {
form_set_error('title', t('You have to specify a valid title.'));
}
}
...

However, note that the title field is only validated if $node->title is set.
If the form lacks an 'edit[title]' element, though $node->title is not set the validation will succeed, and a node with an empty title will be created.
Malicious or improperly coded forms can thus circumvent the validation scheme. Circumventing the validation scheme is possible with all node modules that use isset as above (most included with Drupal do).

One possible fix is replace the individual if-isset's for each element (which are needed to distinguish between a blank form for creating a new node and a form that has been submitted) with a check on 'op' to see if the form has been submitted.