CWE-178 Improper Handling of Case Sensitivity
baseThe product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (146)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-12812US | critical9.8OT critical | KEV | ||
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted… | ||||
| CVE-2021-24347US | high8.8 | Exploit | ||
The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be execu… | ||||
| CVE-2001-0766US | critical9.8 | Exploit | ||
Apache on MacOS X Client 10.0.3 with the HFS+ file system allows remote attackers to bypass access restrictions via a URL that contains some characters whose case is not matched by… | ||||
| CVE-2003-0411US | high7.5 | Exploit | ||
Sun ONE Application Server 7.0 for Windows 2000/XP allows remote attackers to obtain JSP source code via a request that uses the uppercase ".JSP" extension instead of the lowercase… | ||||
| CVE-2025-27636US | — | Exploit | ||
Bypass/Injection vulnerability in Apache Camel components under particular conditions.
This issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from 4.8.0 through <= 4.8.4,… | ||||
| CVE-2018-9845US | critical9.8 | — | ||
Etherpad Lite before 1.6.4 is exploitable for admin access. | ||||
| CVE-1999-0239US | high7.5 | Exploit | ||
Netscape FastTrack Web server lists files when a lowercase "get" command is used instead of an uppercase GET. | ||||
| CVE-2007-3365US | high7.5 | Exploit | ||
MyServer 0.8.9 and earlier does not properly handle uppercase characters in filename extensions, which allows remote attackers to obtain sensitive information (script source code)… | ||||
| CVE-2026-54763US | critical10.0OT elevated | — | ||
Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical-cased spoof… | ||||
| CVE-2023-3545US | critical9.8 | — | ||
Improper sanitisation in `main/inc/lib/fileUpload.lib.php` in Chamilo LMS <= v1.11.20 on Windows and Apache installations allows unauthenticated attackers to bypass file upload sec… | ||||
| CVE-2005-0269US | critical9.8 | — | ||
The file extension check in GNUBoard 3.40 and earlier only verifies extensions that contain all lowercase letters, which allows remote attackers to upload arbitrary files via file… | ||||
| CVE-2004-2154US | critical9.8 | — | ||
CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowerca… | ||||
| CVE-2004-2214US | critical9.8 | — | ||
Mbedthis AppWeb HTTP server before 1.1.3 allows remote attackers to bypass access restrictions via a URI with mixed case characters. | ||||
| CVE-2002-1820US | critical9.8 | — | ||
register.php in Ultimate PHP Board (UPB) 1.0 and 1.0b uses an administrative account Admin with a capital "A," but allows a remote attacker to impersonate the administrator by regi… | ||||
| CVE-2002-2119US | critical9.8 | — | ||
Novell eDirectory 8.6.2 and 8.7 use case insensitive passwords, which makes it easier for remote attackers to conduct brute force password guessing. | ||||
| CVE-2026-7808US | critical9.8 | — | ||
justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potentially leadin… | ||||
| CVE-2026-5388US | critical9.8 | — | ||
justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passth… | ||||
| CVE-2025-59944US | critical9.8 | — | ||
Cursor is a code editor built for programming with AI. Versions 1.6.23 and below contain case-sensitive checks in the way Cursor IDE protects its sensitive files (e.g., */.cursor/m… | ||||
| CVE-2022-29604US | critical9.8 | — | ||
An issue was discovered in ONOS 2.5.1. An intent with an uppercase letter in a device ID shows the CORRUPT state, which is misleading to a network operator. Improper handling of ca… | ||||
| CVE-2021-32163US | critical9.8OT elevated | — | ||
Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization. | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan