CWE-472: Assumed-Immutable Parameter Tampering
The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
Also known as External Control of Assumed-Immutable Web Parameter.
A kind of CWE-642 External Control of Critical State Data.
From the CWE List. © The MITRE Corporation.
Newest
- vitejs vite, red hat advanced cluster security 4, ansible automation platform 2 +9 more +11 moreVite has a `server.fs.deny` bypass with queries8.2 High
- openclawOpenClaw < 2026.3.22 - allowProfiles Bypass via Profile Mutation and Runtime Selection7.6 High
- payloadcms payloadPayload has Unvalidated Input in Password Recovery Endpoints9.1 Critical
- google chromeInteger overflow in ANGLE in Google Chrome on Windows prior to 146.0.7680.178 allowed a remote...7.5 High
- google chromeInteger overflow in Codecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to...8.8 High
- google chromeInteger overflow in Fonts in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to...8.8 High
- google chromeInteger overflow in ANGLE in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to...8.8 High
- google chromeInteger overflow in Dawn in Google Chrome on Mac prior to 146.0.7680.153 allowed a remote...4.3 Medium
- google chromeInteger overflow in ANGLE in Google Chrome on Windows prior to 146.0.7680.153 allowed a remote...8.8 High
- google chromeInteger overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to...8.8 High
- google chromeInteger overflow in Skia in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to...8.8 High
- google chromeInteger overflow in ANGLE in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to...8.8 High
- google chromeInteger overflow in V8 in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to...8.8 High
- weintek cmt-ctrl01, cmt-svrx-820, cmt3072xh +1 more +3 moreExternal Control of Assumed-Immutable Web Parameter in Weintek cMT X Series HMI EasyWeb Service8.7 High
- mintlify, mintlify platform +1 moreThe Deployment Infrastructure in Mintlify Platform before 2025-11-15 allows remote attackers to...4.9 Medium
- cerebrate-project cerebrateUsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to...9.4 Critical
- google chromeInteger overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to...8.8 High
- google chromeInteger overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to...8.8 High
- fujifilm healthcare americas corporation synapse mobilitySynapse Mobility 8.0, 8.0.1, 8.0.2, 8.1, and 8.1.1 contain a privilege escalation vulnerability...5.3 Medium
- opexus foiaxpress public access link (pal), opexustech foiaxpress public access link +1 moreOPEXUS FOIAXpress Public Access Link (PAL) state and territory list unauthorized modification5.3 Medium
- thememove minimogwp – the high converting ecommerce wordpress themeMinimogWP – The High Converting eCommerce WordPress Theme <= 3.9.0 - Unauthenticated Price Manipulation7.5 High
- google chromeInteger overflow in V8 in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to...8.8 High
- No product listedfblog through 983bede allows account takeover via the password reset feature because SERVER_NAME...9.8 Critical
- No product listedHashview 0.8.1 allows account takeover via the password reset feature because SERVER_NAME is not...9.8 Critical
- google chromeInteger overflow in V8 in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to...8.8 High
- sap se s4/hana (odata meta-data property)Missing Authorization check in SAP S4/HANA (OData meta-data property)4.3 Medium
- bluewave checkmateIn BlueWave Checkmate through 2.0.2 before b387eba, a profile edit request can include a role...8.8 High
- craft cms, craftcms craft cms +1 moreCraft CMS stores user-provided content in session files6.9 Medium
- bluewave checkmateIn BlueWave Checkmate through 2.0.2 before d4a6072, an invite request can be modified to specify...8.1 High
- wpswings upsell funnel builder for woocommerce – create upsells, cross-sells, order bumps, frequently bought, and popups.Upsell Funnel Builder for WooCommerce <= 3.0.0 - Unauthenticated Order Manipulation5.3 Medium
- mra13 simple shopping cartWordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Product Price Manipulation7.5 High
- sap se field logisticsOData meta-data property entity tampering in SAP Field Logistics4.3 Medium
- codelit courselitCodeLit CourseLit before 0.57.5 allows Parameter Tampering via a payment plan associated with the...3.1 Low
- sap se s4core entityOdata meta-data tampering in SAP S4CORE entity4.3 Medium
- sylius paypalpluginSylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout6.5 Medium
- securenvoy securaccessShearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six...8.6 High
- sylius paypalpluginSylius PayPal Plugin Payment Amount Manipulation Vulnerability6.5 Medium
- sendquick enteraSendQuick Entera devices before 11HF5 are vulnerable to CAPTCHA bypass via the captcha parameter5.3 Medium
- archerIn Archer Platform 6 through 6.14.00202.10024, an authenticated user with record creation...1.8 Low
- ikm sanchayaAn issue in the Property Tax Payment Portal in Information Kerala Mission SANCHAYA v3.0.4 allows...7.5 High
- google chromeInteger overflow in Skia in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to...8.8 High
- optimizely configured commerceAn issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity...7.5 High
- teampassTeamPass privileges issue5.4 Medium
- issuetrakUnauthorized Modification of Ticket Requester5.3 Medium
- google chromeInteger overflow in Layout in Google Chrome prior to 129.0.6668.89 allowed a remote attacker to...8.8 High
- google chromeInteger overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to...8.8 High
- stylemixthemes cost calculator builder pro, cost calculator builder +1 moreCost Calculator Builder PRO <= 3.2.1 - Unauthenticated Price Manipulation5.3 Medium
- dotonpaper pinpoint booking system, pinpoint booking system +1 moreWordPress Pinpoint Booking System plugin <= 2.9.9.3.4 - Parameter Tampering6.5 Medium
- wpdevart booking calendar, appointment booking system, booking calendar +1 moreWordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Bypass vulnerability3.7 Low
- smub wpforms – easy form builder for wordpress – contact forms, payment forms, surveys, & more, wordpress contact form drag and drop form builder +1 moreContact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation5.3 Medium
- Show moreLoading…