CWE-915: Mass Assignment
The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Also known as Improperly Controlled Modification of Dynamically-Determined Object Attributes, AutoBinding, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- alternativecommerce, drupal alternativecommerce (basket) +1 moreDrupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-0389.8 Critical
- budibaseBudibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign9.0 Critical
- js-cookie javascript cookie, js-cookie, red hat cryostat 4 on rhel 9 +24 more +26 moreJavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection7.5 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass.5.3 Medium
- berriai litellm, red hat exploit intelligence, ansible automation platform 2 +1 more +3 moreLiteLLM < 1.83.10 Privilege Escalation via User Update8.7 High
- internlm lmdeployLMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out7.8 High
- flowiseFlowise - Mass Assignment in PUT /api/v1/user Allows Password Hash Override6.0 Medium
- typo3 extension "frontend user registration"Broken Access Control in extension "Frontend User Registration" (sf_register)6.9 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation5.4 Medium
- electermelecterm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmark9.4 Critical
- flowiseai flowiseFlowise: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover7.7 High
- flowiseai flowiseFlowise: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover7.7 High
- flowiseai flowiseFlowise: DatasetRow create+update mass-assignment allows cross-workspace row takeover7.7 High
- flowiseai flowiseFlowise: Dataset create+update mass-assignment allows cross-workspace dataset takeover7.7 High
- flowiseai flowiseFlowise: CustomTemplate create+update mass-assignment allows cross-workspace template takeover7.7 High
- flowiseai flowiseFlowise: Assistant create+update mass-assignment allows cross-workspace assistant takeover7.7 High
- flowiseai flowiseFlowise: Mass Assignment in Assistant Update Endpoint Allows Cross-Workspace Resource Reassignment7.6 High
- flowiseai flowiseFlowise: Mass Assignment in Chatflow Update Endpoint Allows Cross-Workspace AgentFlow Reassignment7.6 High
- flowiseai flowiseFlowise: Mass Assignment in Tool Update Endpoint Allows Cross-Workspace Resource Reassignment7.6 High
- flowiseai flowiseFlowise: Mass Assignment in Variable Update Endpoint Allows Cross-Workspace Resource Reassignment7.6 High
- cp0204 quark-auto-saveQuark Drive (quark-auto-save) < 0.8.5 Mass Assignment via POST /update8.7 High
- kysely-org kyselyKysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`7.5 High
- No product listedCosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure...5.7 Medium
- No product listedCosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure...7.3 High
- pfsenseNetgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the...9.9 Critical
- pfsenseNetgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file...9.1 Critical
- divvydrive information technologies inc. divvydriveInput Data Manipulation in DivvyDrive Information Technologies' DivvyDrive8.3 High
- axios, red hat cryostat 4, gatekeeper 3 +45 more +47 moreAxios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking7.4 High
- apache camel, red hat build of apache camel 4.18.1 for spring boot 3.5.14, fuse 7 +2 more +4 moreApache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code Execution10.0 Critical
- axios, red hat cryostat 4, gatekeeper 3 +57 more +59 moreAxios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy4.8 Medium
- axios, red hat cryostat 4, gatekeeper 3 +59 more +61 moreAxios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`6.5 Medium
- axios, red hat cryostat 4, gatekeeper 3 +57 more +59 moreAxios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking7.4 High
github.com/k8sgpt-ai/k8sgptGok8sGPT has Prompt Injection through its k8sGPT-Operator8.7 High- aws ops wheelPrivilege Escalation via Self-Writable Cognito Custom Attribute in AWS Ops Wheel8.7 High
- apache activemq, activemq web +1 moreApache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues6.5 Medium
- freescout-help-desk freescoutFreeScout's Mass Assignment in Mailbox Connection Settings Enables Silent Email Exfiltration9.0 Critical
- givanz vvvebVvveb < 1.0.8.1 Privilege Escalation via admin/user/save8.7 High
- flowiseai flowiseFlowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR)7.6 High
- josdejong mathjs, red hat developer hub, enterprise linux 10 +5 more +7 moreMath.js: Unsafe object property setter in mathjs8.8 High
- flowiseai flowiseFlowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association8.1 High
- kimaiKimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate4.3 Medium
- josdejong mathjs, red hat cryostat 4, developer hub +6 more +8 moreUnsafe array index getter in mathjs8.8 High
- axios, red hat cryostat 4, gatekeeper 3 +63 more +65 moreAxios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain4.8 Medium
- canonical lxdUpdate of type field in restricted TLS certificate allows privilege escalation to cluster admin9.1 Critical
- amazon research and engineering studio, aws research and engineering studio (res) +1 moreImproper Control of User-Modifiable Attributes in RES CreateSession API8.7 High
- directusDirectus has a Path Traversal and Broken Access Control in File Management API8.5 High
- nyariv sandboxjsSandboxJS: Sandbox integrity escape10.0 Critical
- linuxfoundation onnxONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.8.6 High
- z-9527 adminz-9527 admin User Update Endpoint user.js dynamically-determined object attributes5.3 Medium
- No product listedgougucms User Registration Login.php reg_submit dynamically-determined object attributes5.3 Medium
- Show moreLoading…