CWE-436 Interpretation Conflict
classProduct A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (207)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-63030US | —OT critical | KEV | ||
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (C… | ||||
| CVE-2025-48384US | —OT critical | KEV | ||
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading… | ||||
| CVE-2021-40870US | critical9.8OT critical | KEV | ||
An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to ex… | ||||
| CVE-2025-25292US | critical9.8 | — | ||
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 a… | ||||
| CVE-2025-25291US | critical9.8 | — | ||
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 a… | ||||
| CVE-2021-28474US | medium6.5 | — | ||
Microsoft SharePoint Server Remote Code Execution Vulnerability | ||||
| CVE-2019-17596US | high7.5 | Exploit | ||
Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as tra… | ||||
| CVE-2022-37436US | medium5.3 | — | ||
Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. I… | ||||
| CVE-2022-23773US | high7.5 | Exploit | ||
cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is… | ||||
| CVE-2023-24813US | critical9.8 | — | ||
Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can still call arbitrary URLs with arbitrary… | ||||
| CVE-2021-45327US | critical9.8OT elevated | — | ||
Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a remote malisious user ex… | ||||
| CVE-2020-10180US | critical9.8 | — | ||
The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. This affects versions before 1294 of Smart Security Premium, Internet Secur… | ||||
| CVE-2019-19589US | critical9.8 | — | ||
The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives. Note: It has been argued that "The vulnerabil… | ||||
| CVE-2026-7808US | critical9.8 | — | ||
justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potentially leadin… | ||||
| CVE-2026-47767US | critical9.8 | — | ||
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated… | ||||
| CVE-2026-8034US | critical9.8 | — | ||
A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal services by exploiting… | ||||
| CVE-2026-32052US | critical9.8OT elevated | — | ||
OpenClaw versions prior to 2026.2.24 contain a command injection vulnerability in the system.run shell-wrapper that allows attackers to execute hidden commands by injecting positio… | ||||
| CVE-2024-24754US | critical9.8 | — | ||
Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lambda event is converte… | ||||
| CVE-2019-25101US | critical9.8 | — | ||
A vulnerability classified as critical has been found in OnShift TurboGears 1.0.11.10. This affects an unknown part of the file turbogears/controllers.py of the component HTTP Head… | ||||
| CVE-2023-29406US | medium6.5 | Exploit | ||
The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1… | ||||
04
attack patterns (3)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan