CWE-15: External Control of System or Configuration Setting
One or more system settings or configuration elements can be externally controlled by a user.
A kind of CWE-642 External Control of Critical State Data.
From the CWE List. © The MITRE Corporation.
Newest
- dell powerscale onefsDell PowerScale OneFS, versions 9.10.0.0 through 9.10.1.5 and versions 9.11.0.0 through 9.12.0.1,...3.4 Low
- openclawOpenClaw < 2026.2.22 - Remote Code Execution via Shell Startup Environment Variable Injection in system.run7.7 High
openclawnpmOpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands7.3 HighopenclawnpmOpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths5.3 Medium- openclawOpenClaw < 2026.2.21 - Environment Variable Injection via Config env.vars6.9 Medium
- openclawOpenClaw < 2026.2.22 - Allowlist Bypass via sort Configuration in safeBins7.1 High
- openclawOpenClaw < 2026.2.22 - Remote Code Execution via SHELLOPTS/PS4 Environment Injection in system.run7.5 High
- openclawOpenClaw < 2026.2.26 - Approval Context-Binding Weakness in system.run via host=node2.0 Low
- openclawOpenClaw Skill Env applySkillConfigenvOverrides code injection5.3 Medium
- yosefhayim ebay-mcpeBay API MCP Server Affected by Environment Variable Injection8.3 High
- wpfable shopireShopire <= 1.0.57 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install4.3 Medium
- anysphere cursorCursor has a Terminal Tool Allowlist Bypass via Environment Variables7.2 High
- sap se fiori app (intercompany balance reconciliation)Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation)5.1 Medium
- socketdev firewall-releaseExternal Control of System or Configuration Setting and Uncontrolled Search Path Element in sfw7.3 High
- remram44 taguetteTaguette vulnerable to password reset link poisoning7.1 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal has External Control of System or Configuration Settings2.3 Low
- danfoss ak-sm8xxa seriesPost auth nginx configuration injection in Danfoss AK-SM8xxA Series6.8 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +3 more +5 moreNetavark: podman: netavark may resolve hostnames to unexpected hosts3.7 Low
- wftpserver wing ftp server, wing ftp server ftp server +1 moreWing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the...3.4 Low
- growatt cloud portalGrowatt Cloud portal External Control of System or Configuration Setting6.9 Medium
- kubernetes ingress-nginxingress-nginx controller - configuration injection via unsanitized auth-url annotation8.8 High
- kubernetes ingress-nginxingress-nginx controller - configuration injection via unsanitized mirror annotations8.8 High
- kubernetes ingress-nginxingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation8.8 High
- ge vernova b30 multilin, b90 multilin, c30 multilin +16 more +18 moreAn improper input validation in GE Vernova UR IED family devices from version 7.0 up to 8.60...6.1 Medium
- cordaware bestinformed infoclientLocal Privilege Escalation via Config Manipulation8.5 High
- traffic alert and collision avoidance system (tcas) ii collision avoidance systemsTraffic Alert and Collision Avoidance System (TCAS) II has an External Control of System or Configuration Setting vulnerability7.1 High
- wavlink ac3000, wl-wn533a8 firmware +1 moreMultiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup()...9.1 Critical
- wavlink ac3000, wl-wn533a8 firmware +1 moreMultiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup()...9.1 Critical
- wavlink ac3000, wl-wn533a8 firmware +1 moreMultiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup()...9.1 Critical
- wavlink ac3000, wl-wn533a8 firmware +1 moreAn external config control vulnerability exists in the nas.cgi set_nas() functionality of Wavlink...9.1 Critical
- wavlink ac3000, wl-wn533a8 firmware +1 moreAn external config control vulnerability exists in the openvpn.cgi openvpn_client_setup()...9.1 Critical
- wavlink ac3000, wl-wn533a8 firmware +1 moreMultiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd...9.1 Critical
- wavlink ac3000, wl-wn533a8 firmware +1 moreMultiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd...9.1 Critical
- wavlink ac3000, wl-wn533a8 firmware +1 moreMultiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd...9.1 Critical
- wavlink ac3000, wl-wn533a8 firmware +1 moreMultiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality...9.1 Critical
- wavlink ac3000, wl-wn533a8 firmware +1 moreAn external config control vulnerability exists in the nas.cgi set_smb_cfg() functionality of...9.1 Critical
- wavlink ac3000, wl-wn533a8 firmware +1 moreMultiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality...9.1 Critical
- wavlink ac3000, wl-wn533a8 firmware +1 moreMultiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality...9.1 Critical
- huawei emui, harmonyos +1 moreSecurity vulnerability in the HiView module Impact: Successful exploitation of this vulnerability...7.3 High
- abb matrix series, nexus series, aspect-ent-12 firmware +19 more +21 moreService Control8.8 High
- abb matrix series, nexus series, aspect-ent-12 firmware +20 more +22 moreInformation Disclosure8.8 High
- advantech eki-6333ac-1gpo, eki-6333ac-2g, eki-6333ac-2gd +3 more +5 moreA CWE-15 "External Control of System or Configuration Setting" was discovered affecting the...7.2 High
- flowiseFlowise - Remote Code Execution via overrideConfig Parameter9.3 Critical
- postgresqlPostgreSQL PL/Perl environment variable changes execute arbitrary code8.8 High
github.com/gitpod-io/gitpodGo,github.com/gitpod-io/gitpod/components/server/goGo,github.com/gitpod-io/gitpod/components/ws-proxyGo +1 more +3 moregithub.com/gitpod-io/gitpod vulnerable to Cookie Tossing4.1 Medium- parisneo lollms-webui, parisneo/lollms-webui, lollms web ui +2 moreRemote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webui9.8 Critical
- avg antivirus free, bitdefender antivirus, antivirus plus +2 more +4 moreLocal privilege escalation in Bitdefender Total Security (VA-11168)7.8 High
- fedoraproject unbound, red hat enterprise linux 10, enterprise linux 6 +31 more +33 moreUnbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalation8.0 High
- micronaut-projects micronaut-core, objectcomputing micronaut +1 moremicronaut-core management endpoints vulnerable to drive-by localhost attack5.1 Medium
- dompdf php-svg-libphp-svg-lib unsafe attributes merge when parsing `use` tag8.3 High
- Show moreLoading…