CWE-470: Reflection Injection
The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
Also known as Use of Externally-Controlled Input to Select Classes or Code, Unsafe Reflection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- geonetwork core-geonetworkGeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter9.1 Critical
- fasterxml jackson-databindjackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path5.3 Medium
- helge17 tuxguitarTuxGuitar: Arbitrary Code Execution via maliciously crafted `.tg` file8.5 High
- yamcsYamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)9.8 Critical
- papercut mf/ng, mf, ng +1 more +3 morePaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector9.4 Critical
- cakephp debug kitDebugKit: MailPreview contains unsafe reflection4.3 Medium
- gemelo-ai vocosVocos through 0.1.0 Arbitrary Code Execution via Unrestricted class_path in Model Configuration8.6 High
- facebookresearch hydraHydra: hydra.utils.instantiate with untrusted config can lead to code execution7.8 High
- elct9620 kobakoKobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)10.0 Critical
- rabbitmq rabbitmq-java-clientRabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading7.5 High
- No product listedForm::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to add_e…9.1 Critical
libhtml-formhandler-perlDebian,perl-HTML-FormHandlerMageia +1 moreHTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data…9.1 Critical- openstack horizon, the opennms group meridian +1 moreOpenNMS JEXL sandbox bypass in Measurements REST API allows ROLE_USER to load arbitrary classes5.4 Medium
- apache rangerApache Ranger: Remote Code Execution via Arbitrary Class Instantiation9.8 Critical
- sonatype nexus repository, nexus repository manager +1 moreNexus Repository - Arbitrary Class Instantiation via Unsafe Realm Configuration7.2 High
- statamic cmsStatamic: Unsafe method invocation via Antlers template resolution allows data destruction6.5 Medium
- ibm websphere application server, websphere application server - liberty +1 moreMultiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU8.1 High
- devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement pluginShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API7.2 High
- getgrav gravGrav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint8.6 High
- masci banksBanks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE7.5 High
- openidentityplatform openamOpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback9.8 Critical
- apache opennlpApache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML5.6 Medium
- @tanstack react-routerReact Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration6.1 Medium
- getgrav gravGrav before 2.0.9 Remote Code Execution via FlexDirectory8.7 High
- progress telerik ui for asp.net ajaxDialogHandler Provider Type Tampering Vulnerability in Telerik UI for ASP.NET AJAX8.1 High
- progress telerik ui for asp.net ajaxRadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX8.1 High
- lightningai pytorch lightning, lightning-ai pytorch-lightning +1 morePyTorch Lightning Arbitrary Code Execution via _instantiator Hyperparameter8.4 High
- apache software foundation iotdbApache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC9.8 Critical
- perl dbiDBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile8.8 High
- swaldman mchange-commons-javamchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"7.1 High
- nvidia megatron-bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper...7.8 High
- ibm websphere extreme scaleIBM WebSphere eXtreme Scale's OQL is affected by remote code execution7.5 High
- jenkins project pipeline: groovy plugin, jenkins pipeline\ +1 moreJenkins Pipeline: Groovy Plugin vulnerable to unrestricted instantiation of types4.3 Medium
- messagepack, messagepack-csharp +1 moreMessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows8.2 High
- messagepack, messagepack-csharp +1 moreMessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments6.3 Medium
- linuxfoundation spinnakerSpinnaker: Non-safe yaml deserialization allowing RCE when using specific types8.8 High
- statamic cmsStatamic CMS vulnerable to unsafe method invocation via collection sorting allows data destruction7.4 High
- encode starletteStarlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`5.3 Medium
- apache calciteApache Calcite: A user-controled model can load arbitrary classes, leading to code execution6.5 Medium
- spaceapplications yamcsYamcs: Remote Code Execution via Mission Database algorithm override9.8 Critical
- getkirby kirbyKirby: Arbitrary Method Call via REST API search and collection query endpoints8.7 High
- convoypanel panelCtrlPanel: Authenticated Remote Code Execution via Dynamic Class Instantiation in SettingsController.php6.6 Medium
- amazon redshift jdbc driverRemote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver9.2 Critical
- mervinpraison praisonai, praison praisonaiagents +1 morePraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute8.6 High
- craftcms cmsCraft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior8.6 High
- apache opennlp, red hat build of apache camel for spring boot 4, data grid 8 +5 more +7 moreApache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader9.8 Critical
- statamic cms, statamic +1 moreStatamic: Unsafe method invocation via query value resolution allows data destruction8.1 High
- smartvpn smart vpnSmart VPN 1.1.3.0 Denial of Service via Search6.9 Medium
- zabbixUnauthenticated arbitrary PHP class instantiation6.9 Medium
- craftcms cms, craft cms +1 moreCraft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior8.6 High
- Show moreLoading…