CWE-472: Assumed-Immutable Parameter Tampering
The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
Also known as External Control of Assumed-Immutable Web Parameter.
A kind of CWE-642 External Control of Critical State Data.
From the CWE List. © The MITRE Corporation.
Newest
- marcoscamara01 ecommerce template Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier 7.1 High
- mattermost, mattermost server +1 more Mattermost SAML RelayState forgery allows unauthorized team membership 7.1 High
- wheels Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without... 8.1 High
- lycheeorg lychee Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request 8.3 High
- invoiceshelf InvoiceShelf trusts client-supplied document totals 5.3 Medium
- ec-cube co.,ltd. amazonpay plugin (4.0 series), amazonpay v2 plugin (4.0/4.1 series), amazonpay v2 plugin (4.2/4.3 series) +1 more +3 more External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4... 5.3 Medium
- villatheme salevo WordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability 5.3 Medium
- ph7software ph7builder pH7Builder before 18.5.1 Payment Bypass via Payment Module MainController 7.1 High
- openstack zaqar In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in... 6.1 Medium
- unknown magee shortcodes Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay via Contact Form 5.3 Medium
- unknown webtoffee gift cards for woocommerce WebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticated Gift Card Amount Manipulation via wt_credit_amount 5.3 Medium
- scottpaterson easy paypal & stripe buy now button Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Payment Amount Manipulation via Client-Supplied Price 5.3 Medium
- bookly Bookly < 28.3 - Unauthenticated Payment Bypass via Booking Price Manipulation 5.3 Medium
- misp MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' Reports 8.3 High
- magnigenie restropress RestroPress < 3.4.6 - Unauthenticated Price Manipulation via Cart Add-ons 5.3 Medium
- j2commerce.com j2store extension for joomla Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 8.7 High
- saad iqbal wp easypay WordPress WP EasyPay plugin <= 4.5.3 - Bypass Vulnerability vulnerability 5.3 Medium
- j2commerce.com j2store extension for joomla Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 8.7 High
- jenkins project jenkins In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins... 5.4 Medium
- metagauss registrationmagic RegistrationMagic 6.0.0.0 - 6.0.9.8 - Unauthenticated Payment Bypass via Zero Quantity 5.3 Medium
- balbooa.com balbooa forms extension for joomla Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 7.7 High
- unknown wallet system for woocommerce Wallet System for WooCommerce < 2.7.10 - Customer+ Checkout Price Manipulation via Unvalidated Wallet Amount 6.5 Medium
- unknown wpc name your price for woocommerce WPC Name Your Price for WooCommerce < 2.2.5 - Unauthenticated Price Manipulation via Select Mode 7.5 High
- unknown event booking manager for woocommerce (pro) Event Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via Client-Controlled Ticket Price 5.3 Medium
- thimpress wp hotel booking WP Hotel Booking < 2.3.3 - Unauthenticated Payment Bypass via Price Manipulation 5.3 Medium
- unknown cocart CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation 7.5 High
- mohammadr3z المنتور فارسی Persian Elementor (المنتور فارسی) <= 2.8.1 - Unauthenticated Price Manipulation via ZarinPal Widget 5.3 Medium
- abis technology ltd. co. avesis Improper Access Control in Abis Technology's AVESİS 5.3 Medium
- saturday drive ninja forms Ninja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio Fields 8.7 High
- redhat build of keycloak, red hat build of keycloak 26.6, build of keycloak 26.6.7 +3 more +5 more Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session 5.4 Medium
- skillable scorm lab launch integration The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not... 6.3 Medium
- tryghost ghost Ghost: Paid gift memberships obtainable at minimal cost via the donations feature 5.3 Medium
- google chrome Integer overflow in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to... 8.8 High
- google chrome Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who... 8.3 High
- google chrome Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to... 9.6 Critical
- google chrome Integer overflow in ANGLE in Google Chrome on Windows prior to 150.0.7871.46 allowed a remote... 5.3 Medium
- google chrome Integer overflow in WebNN in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to... 6.5 Medium
- google chrome Integer overflow in Safe Browsing in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote... 8.1 High
- google chrome Integer overflow in Fonts in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to... 8.8 High
- google chrome Integer overflow in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who... 8.3 High
- google chrome Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker... 8.3 High
- google chrome Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker... 9.6 Critical
- google chrome Integer overflow in Mojo in Google Chrome prior to 149.0.7827.201 allowed a remote attacker who... 8.3 High
- wpmanageninja best payments plugin for wp WordPress Best Payments Plugin for WP plugin <= 4.6.19 - Payment Bypass vulnerability 7.5 High
- qnap systems inc. qts, quts hero, qutscloud +2 more QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) 1.2 Low
- google chrome Integer overflow in libyuv in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who... 5.3 Medium
- google chrome Out of bounds read in Media in Google Chrome on ChromeOS prior to 149.0.7827.103 allowed a remote... 5.3 Medium
- google chrome Integer overflow in Media in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote... 8.3 High
- google chrome Integer overflow in libyuv in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who... 8.3 High
- google chrome Integer overflow in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a local... 5.0 Medium
- Show olderLoading…