CWE-155 Improper Neutralization of Wildcards or Matching Symbols
Description
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as wildcards or matching symbols when they are sent to a downstream component.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-155 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-wpmr-8h3q-fwj7 | CVE-2026-87016 | HIGH |
Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite |
2026-09-10 | |
| GHSA-6v4m-fw66-8r4x | CVE-2026-73412 | MODERATE |
Shescape: Path disclosure on Unix with Zsh |
2026-08-12 | |
| GHSA-394x-vwmw-crm3 | - | HIGH | - |
AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN |
2026-03-20 |
| GHSA-78fx-h6xr-vch4 | CVE-2025-27515 | MODERATE | - |
Laravel has a File Validation Bypass |
2025-03-12 |
| GHSA-3wgq-h4fr-cwg5 | - | MODERATE | - |
laravel-crud-wizard-free has File Validation Bypass |
2025-03-12 |
| GHSA-fc89-jghx-8pvg | CVE-2025-24376 | MODERATE |
KubeWarden's AdmissionPolicy and AdmissionPolicyGroup policies can be used to alter PolicyReport resources |
2025-02-05 | |
| GHSA-7p8f-8hjm-wm92 | CVE-2022-21646 | HIGH |
Lookup operations do not take into account wildcards in SpiceDB |
2022-01-13 | |
| GHSA-xggx-fx6w-v7ch | CVE-2019-3802 | MODERATE |
Improper Neutralization of Wildcards or Matching Symbols |
2021-08-04 |