CWE-115 Misinterpretation of Input
baseThe product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (53)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-0604US | critical9.8OT critical | KEV | ||
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote… | ||||
| CVE-2026-17351US | critical9.0 | Exploit | ||
The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to parse, via sqlparse, as exactly one non-transact… | ||||
| CVE-2020-27846US | critical9.8 | — | ||
A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confiden… | ||||
| CVE-2004-2590US | high10.0 | — | ||
Unspecified vulnerability in meindlSOFT Cute PHP Library (aka cphplib) 0.46 has unknown impact and attack vectors, related to regular expressions. | ||||
| CVE-2024-38428US | critical9.1 | — | ||
url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the u… | ||||
| CVE-2021-1587US | high8.6 | — | ||
A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to ca… | ||||
| CVE-2021-28965US | high7.5 | — | ||
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced aft… | ||||
| CVE-2018-12116US | high7.5 | — | ||
Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of… | ||||
| CVE-2026-23092US | high7.8 | — | ||
In the Linux kernel, the following vulnerability has been resolved:
iio: dac: ad3552r-hs: fix out-of-bound write in ad3552r_hs_write_data_source
When simple_write_to_buffer() suc… | ||||
| CVE-2019-0013US | high7.5 | — | ||
The routing protocol daemon (RPD) process will crash and restart when a specific invalid IPv4 PIM Join packet is received. While RPD restarts after a crash, repeated crashes can re… | ||||
| CVE-2018-9547US | high7.8 | — | ||
In unflatten of GraphicBuffer.cpp, there is a possible bad fd close due to improper input validation. This could lead to local escalation of privilege in the system server with no… | ||||
| CVE-2023-48950US | high7.5 | — | ||
An issue in the box_col_len function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement. | ||||
| CVE-2022-20915US | high7.4 | — | ||
A vulnerability in the implementation of IPv6 VPN over MPLS (6VPE) with Zone-Based Firewall (ZBFW) of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cau… | ||||
| CVE-2019-1230US | medium6.8 | — | ||
An information disclosure vulnerability exists when the Windows Hyper-V Network Switch on a host operating system fails to properly validate input from an authenticated user on a g… | ||||
| CVE-2007-5793US | high7.1 | — | ||
Stonesoft StoneGate IPS before 4.0 does not properly decode Fullwidth/Halfwidth Unicode encoded data, which makes it easier for remote attackers to scan or penetrate systems and av… | ||||
| CVE-2019-0690US | medium6.8 | — | ||
A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system,… | ||||
| CVE-2019-5773US | medium6.5 | — | ||
Insufficient origin validation in IndexedDB in Google Chrome prior to 72.0.3626.81 allowed a remote attacker who had compromised the renderer process to bypass same origin policy v… | ||||
| CVE-2022-21672US | medium6.5 | — | ||
make-ca is a utility to deliver and manage a complete PKI configuration for workstations and servers. Starting with version 0.9 and prior to version 1.10, make-ca misinterprets Moz… | ||||
| CVE-2019-0011US | medium6.5 | — | ||
The Junos OS kernel crashes after processing a specific incoming packet to the out of band management interface (such as fxp0, me0, em0, vme0) destined for another address. By cont… | ||||
| CVE-2025-55303US | medium6.1 | — | ||
Astro is a web framework for content-driven websites. In versions of astro before 5.13.2 and 4.16.18, the image optimization endpoint in projects deployed with on-demand rendering… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan