CWE-914
9 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 9Published CVEs9 of them scored
- 6Last 12 monthspublished in the last year
- 2Critical4 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2019-25777
YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution
YAML
High7.3 - CVE-2026-44006
vm2: Sandbox Escape
patriksimek · vm2
Critical10.0 - CVE-2026-35173
Chyrp Lite has an IDOR via Mass Assignment in Post Model
xenocrat · chyrp-lite
Medium6.5 - CVE-2026-34444
Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr
scoder · lupa
High7.9 - CVE-2025-14085
youlaitech youlai-mall orders improper control of dynamically-identified variables
youlaitech · youlai-mall
Medium5.3 - CVE-2025-14051
youlaitech youlai-mall addresses deleteAddress improper control of dynamically-identified variables
youlaitech · youlai-mall
Medium5.3 - CVE-2024-54198
Information Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP
SAP_SE · SAP NetWeaver Application Server ABAP
High8.5 - CVE-2024-24914
Authenticated Gaia users can inject code or commands by global variables through special HTTP requests. A Security fix that mitigates this vulnerability is…
checkpoint · ClusterXL, Multi-Domain Security Management, Quantum Appliances, Quantum Maestro, Quantum Scalable Chassis, Quantum Security Gateways, Quantum Security Management
High8.0 - CVE-2023-33175
ToUI allows user-specific variables to be shared between users
mubarakalmehairbi · ToUI
Critical9.1