CWE-472 External Control of Assumed-Immutable Web Parameter
baseThe web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (167)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-35939US | medium5.3OT critical | KEV | ||
Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Cra… | ||||
| CVE-2024-25153US | critical9.8 | Exploit | ||
A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory with a specially cr… | ||||
| CVE-2017-5261US | high8.8 | Exploit | ||
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the 'ping' and 'traceroute' functions of the web administrative console expose a file path traversal vulnerabil… | ||||
| CVE-2017-5260US | high8.8 | Exploit | ||
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web administrative console… | ||||
| CVE-2021-1294US | critical9.8 | — | ||
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote a… | ||||
| CVE-2021-1293US | critical9.8 | — | ||
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote a… | ||||
| CVE-2021-1295US | critical9.8 | — | ||
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote a… | ||||
| CVE-2021-1292US | critical9.8 | — | ||
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote a… | ||||
| CVE-2021-1291US | critical9.8 | — | ||
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote a… | ||||
| CVE-2021-1290US | critical9.8 | — | ||
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote a… | ||||
| CVE-2021-1289US | critical9.8 | — | ||
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote a… | ||||
| CVE-2023-24373US | critical9.8 | — | ||
External Control of Assumed-Immutable Web Parameter vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Manipulating Hidden Fields.This issue affects Book… | ||||
| CVE-2026-10019US | high8.8 | — | ||
Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-3538US | high8.8 | — | ||
Integer overflow in Skia in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium se… | ||||
| CVE-2026-3536US | high8.8 | — | ||
Integer overflow in ANGLE in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium s… | ||||
| CVE-2025-10892US | high8.8 | — | ||
Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severit… | ||||
| CVE-2024-7025US | high8.8 | — | ||
Integer overflow in Layout in Google Chrome prior to 129.0.6668.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security seve… | ||||
| CVE-2024-9123US | high8.8 | — | ||
Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security seve… | ||||
| CVE-2021-27770US | high8.8 | — | ||
The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserver. We assume this service is used by the… | ||||
| CVE-2024-50703US | high8.1 | — | ||
TeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different user_id. | ||||
03
attack patterns (4)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan