CWE-99: Improper Control of Resource Identifiers
The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended control sphere.
Also known as Insecure Direct Object Reference, Resource Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- apache software foundation ofbiz Apache OFBiz: Dispatch arbitrary internal services on SFA component 8.1 High
- ibm db2 genius hub Multiple vulnerabilities that affects IBM Db2 Genius Hub 4.3 Medium
- bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection... 5.8 Medium
- bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection... 5.0 Medium
- bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection... 4.0 Medium
- bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection... 8.5 High
- akamai guardicore platform agent Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates... 8.5 High
- wizards of the coast magic: the gathering arena Magic: The Gathering Arena (Windows/Steam client; 2026.59.30.12801.127931.6 and certain later... 3.4 Low
- openbsd openssh In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading... 2.5 Low
- dotnet eshop dotnet eShop Ordering API OrdersApi.cs GetOrderAsync resource injection 5.3 Medium
- krayin laravel-crm Krayin laravel-crm attachment-download Endpoint acl.php resource injection 5.3 Medium
- moquette Moquette fails open when configured authentication or authorization classes cannot load 9.3 Critical
- moquette Moquette client IDs can cause cross-session H2 durable-queue corruption 8.8 High
- moquette Moquette publishes Last-Will messages without enforcing write authorization 8.7 High
- moquette Moquette unbounded per-session message queues allow memory exhaustion 8.7 High
- moquette Moquette deeply nested MQTT topics can cause stack exhaustion 8.7 High
- moquette Moquette malformed shared subscriptions can crash command processing 8.7 High
- moquette Moquette uncaught MQTT command exceptions can terminate shared session event loops 8.7 High
- moquette Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass 9.6 Critical
- omega solution hrm os Omega Solution HRM OS Role Permission Retrieval Endpoint permission resource injection 5.3 Medium
- gitlab Improper Control of Resource Identifiers ('Resource Injection') in GitLab 3.1 Low
- mongodb c driver Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver 5.3 Medium
- mongodb go driver Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite in the MongoDB Go Driver 7.1 High
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 more Microsoft Exchange Server Elevation of Privilege Vulnerability 7.2 High
- macrozheng mall macrozheng mall Portal Endpoint create resource injection 5.3 Medium
- aidc-ai comfyui-copilot AIDC-AI ComfyUI-Copilot Workflow Checkpoint Restore conversation_api.py resource injection 2.3 Low
- medkey-org medkey medkey-org medkey HTTP REST API PatientController.php actionGetPatientById resource injection 5.3 Medium
- sourcecodester human resource management SourceCodester Human Resource Management Employee View detailview.php resource injection 5.3 Medium
- code-projects online hospital management system code-projects Online Hospital Management System viewdoctortimings.php resource injection 5.1 Medium
- ousl-group-brinarybrains school student management system OUSL-GROUP-BrinaryBrains School Student Management System Parents.php marks resource injection 5.3 Medium
- yashpokharna2555 studentmanagementsystem yashpokharna2555 StudentManagementSystem courseDel.php resource injection 5.3 Medium
- dovecot, open-xchange gmbh ox dovecot pro +1 more Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS... 6.8 Medium
- xuxueli xxl-job Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injection 6.3 Medium
- newgen omnidocs Newgen OmniDocs WebApiRequestRedirection resource injection 6.9 Medium
- bichitrogan isp billing software BichitroGan ISP Billing Software Endpoint users-view resource injection 5.3 Medium
- shy2593666979 agentchat Shy2593666979 AgentChat User Endpoint user.py update_user_info resource injection 6.9 Medium
- evershop EverShop Order Order.resolvers.js resource injection 6.3 Medium
- yungifez skuul, skuul school management system +1 more yungifez Skuul School Management System View Fee Invoice fee-invoices resource injection 2.3 Low
- learnhouse LearnHouse Student Assignment Submission sub_file resource injection 5.3 Medium
- hp poly lens desktop, hp, inc. poly lens +1 more Poly Lens Desktop Application – Privilege Escalation 7.3 High
- e4 sistemas mercatus erp E4 Sistemas Mercatus ERP id resource injection 6.9 Medium
- xuxueli xxl-job Xuxueli xxl-job Jobs JobInfoController.java remove resource injection 5.3 Medium
- xuxueli xxl-job Xuxueli xxl-job JobLogController.java getJobsByGroup resource injection 5.3 Medium
- litmuschaos litmus LitmusChaos Litmus resource injection 5.3 Medium
- 201206030 novel-plus xxyopen/201206030 novel-plus File FileController.java remove resource injection 2.3 Low
- abb aspect-enterprise, matrix series, nexus series +2 more Admin Authorized Port (iptables) manipulation (open/close/disable ports) 8.9 High
- codecanyon rise ultimate project manager CodeCanyon RISE Ultimate Project Manager Profile Picture save_profile_image resource injection 5.3 Medium
- hitachi vantara pentaho data integration & analytics Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection') 9.1 Critical
- fcj venture builder appclientefiel FCJ Venture Builder appclientefiel HTTP GET Request ObterPedido resource injection 5.3 Medium
- control id rh id, assaabloy control id rhid +1 more Control iD RH iD PDF Document companyId resource injection 5.3 Medium
- Show olderLoading…