CWE-472 External Control of Assumed-Immutable Web Parameter
baseThe web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (167)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-35939US | medium5.3OT kritisch | KEV | ||
Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Cra… | ||||
| CVE-2024-25153US | critical9.8 | Exploit | ||
A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory with a specially cr… | ||||
| CVE-2017-5261US | high8.8 | Exploit | ||
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the 'ping' and 'traceroute' functions of the web administrative console expose a file path traversal vulnerabil… | ||||
| CVE-2017-5260US | high8.8 | Exploit | ||
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web administrative console… | ||||
| CVE-2021-1294US | critical9.8 | — | ||
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote a… | ||||
| CVE-2021-1293US | critical9.8 | — | ||
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote a… | ||||
| CVE-2021-1295US | critical9.8 | — | ||
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote a… | ||||
| CVE-2021-1292US | critical9.8 | — | ||
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote a… | ||||
| CVE-2021-1291US | critical9.8 | — | ||
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote a… | ||||
| CVE-2021-1290US | critical9.8 | — | ||
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote a… | ||||
| CVE-2021-1289US | critical9.8 | — | ||
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote a… | ||||
| CVE-2023-24373US | critical9.8 | — | ||
External Control of Assumed-Immutable Web Parameter vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Manipulating Hidden Fields.This issue affects Book… | ||||
| CVE-2026-10019US | high8.8 | — | ||
Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-3538US | high8.8 | — | ||
Integer overflow in Skia in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium se… | ||||
| CVE-2026-3536US | high8.8 | — | ||
Integer overflow in ANGLE in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium s… | ||||
| CVE-2025-10892US | high8.8 | — | ||
Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severit… | ||||
| CVE-2024-7025US | high8.8 | — | ||
Integer overflow in Layout in Google Chrome prior to 129.0.6668.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security seve… | ||||
| CVE-2024-9123US | high8.8 | — | ||
Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security seve… | ||||
| CVE-2021-27770US | high8.8 | — | ||
The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserver. We assume this service is used by the… | ||||
| CVE-2024-50703US | high8.1 | — | ||
TeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different user_id. | ||||
03
Angriffsmuster (4)
CAPEC-Angriffsmuster, die dies ausnutzen.
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan