CWE-183: Permissive List of Allowed Inputs
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
Also known as Allowlist / Allow List, Safelist / Safe List, Whitelist / White List.
A kind of CWE-697 Incorrect Comparison.
From the CWE List. © The MITRE Corporation.
Newest
- vorota-ai nmap-mcp nmap-mcp through commit 3636afa Permissive NSE Script Allowlist in scan_vulnerabilities 4.8 Medium
- vllm vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE 8.1 High
- iflytek astron-agent iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist 6.9 Medium
- py-pdf pypdf pypdf: Unvalidated JPEG image data loading 2.3 Low
- microsoft .net 10.0 runtime, .net 11.0 runtime, .net 8.0 runtime +3 more +5 more .NET Information Disclosure Vulnerability 6.5 Medium
- sap se sapui5 Cross Site Scripting (XSS) vulnerability in SAPUI5 4.4 Medium
- @backstage plugin-techdocs-node, backstage, linuxfoundation backstage plugin-techdocs-node +2 more Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml 7.7 High
- rhukster dom-sanitizer rhukster dom-sanitizer SVG Sanitization DOMSanitizer.php url incomplete blacklist 6.9 Medium
- forcepoint security engine (ngfw) Security Policy Bypass in Forcepoint Security Engine (NGFW) 7.9 High
- hkuds nanobot HKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklist 5.3 Medium
- nationalsecurityagency skills-service NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover 9.6 Critical
- sonirico mcp-shell mcp-shell: Secure Mode Allowlist Bypass via Default `/bin/bash` Executable 8.4 High
- openvpn The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5... 4.1 Medium
- dromara maxkey MaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code Theft 8.5 High
- janhq jan Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding 5.3 Medium
- axios axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0 6.9 Medium
- princezuda safestclaw princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist 4.8 Medium
- nextlevelbuilder goclaw nextlevelbuilder GoClaw exec_approval.go ExecApprovalManager.CheckCommand incomplete blacklist 5.3 Medium
- passwordpusher PasswordPusher < 2.8.1 - Redirect-Based XSS via data URI in URL Push Payload 6.3 Medium
- appsmith Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route 8.9 High
- nicolargo glances Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533) 7.4 High
- asus armoury crate A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform... 7.1 High
- anthropic claude code, anthropics claude-code +1 more Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch 6.0 Medium
- nodejs undici undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching 3.7 Low
- apify apify-mcp-server Apify MCP server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching 6.1 Medium
- haxtheweb @haxtheweb/open-apis HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis 8.7 High
- gitoxide, gitoxide gix, gix-submodule +2 more gitoxide - Command Injection via Partial .gitmodules Override in gix-submodule 7.3 High
- netbox-community netbox NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin 8.7 High
-
github.com/tinfoil-factory/netfoilGo Netfoil has incorrect allowlist enforcement 6.9 Medium - axios Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion 5.4 Medium
- axios, red hat cryostat 4, gatekeeper 3 +56 more +58 more Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 7.2 High
- openclaw OpenClaw < 2026.4.15 - Arbitrary Markdown File Read via QMD memory_get 2.3 Low
- openclaw OpenClaw < 2026.4.12 - Improper Authorization via Empty Approver Lists 6.0 Medium
- dataease DataEase has an Arbitrary File Read Vulnerability 8.3 High
- juniper virtual lightweight collector, juniper networks jsi lwc +1 more JSI Virtual Lightweight Collector: Shell escape allows privilege escalation to root 8.4 High
- openclaw OpenClaw < 2026.3.22 - Supply Chain Redirection via Incomplete Host Environment Sanitization 8.5 High
- express xss sanitizer project xss sanitizer, ahmedadelfahim express-xss-sanitizer +1 more Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk) 8.2 High
- openclaw OpenClaw < 2026.3.22 - Settings Reconciliation Bypass via Empty Allowlist 6.3 Medium
- astro Astro: Remote allowlist bypass via unanchored matchPathname wildcard 2.9 Low
- No product listed PbootCMS File Upload file.php incomplete blacklist 5.3 Medium
- vshakitskiy ewe ewe has an Overly Permissive List of Allowed Inputs 5.3 Medium
- mmaitre314 picklescan picklescan - Universal Blocklist Bypass via pkgutil.resolve_name 10.0 Critical
- mongodb inc go driver Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak 6.9 Medium
- mongodb inc ruby driver Unsafe Reflection in Mongoid::Criteria.from_hash 6.9 Medium
- n8n n8n has a Webhook Node IP Whitelist Bypass via Partial String Matching 5.3 Medium
- jetbrains teamcity In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on... 7.7 High
- microsoft purview Microsoft Purview Elevation of Privilege Vulnerability 8.7 High
- filebrowser File Browser Allows Execution of Shell Commands That Can Spawn Other Commands 8.0 High
- bosch rexroth ag ctrlx os - device admin A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS... 7.1 High
- binary-husky binary-husky/gpt academic, gpt academic +1 more Regular Expression Denial of Service (ReDoS) in binary-husky/gpt_academic 6.5 Medium
- Show olderLoading…