CWE-472 External Control of Assumed-Immutable Web Parameter
Description
The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-472 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-xm43-3m56-w3wf | CVE-2026-59817 | MODERATE |
Ghost: Paid gift memberships obtainable at minimal cost via the donations feature |
2026-08-04 | |
| GHSA-hq3p-w4xv-x7vp | CVE-2026-7571 | HIGH |
Keycloak: Access token disclosure and implicit flow bypass via forged client data |
2026-06-04 | |
| GHSA-pp79-hqv6-vmc3 | CVE-2026-32699 | MODERATE | - |
FacturaScripts has Insecure Parameter Handling: Unauthorized Modification of Immutable 'nick' Field |
2026-05-07 |
| GHSA-hp5w-3hxx-vmwf | CVE-2026-34751 | CRITICAL |
Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery |
2026-04-08 | |
| GHSA-g47j-3m2m-74qv | - | MODERATE |
Duplicate Advisory: httparty has multipart/form-data request tampering vulnerability |
2026-01-07 | |
| GHSA-7vrx-9684-xrf2 | CVE-2025-35939 | MODERATE | - |
Craft CMS stores arbitrary content provided by unauthenticated users in session files |
2025-10-22 |
| GHSA-hxg4-65p5-9w37 | CVE-2025-30152 | MODERATE | - |
Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout |
2025-03-20 |
| GHSA-pqq3-q84h-pj6x | CVE-2025-29788 | MODERATE | - |
Sylius PayPal Plugin Payment Amount Manipulation Vulnerability |
2025-03-17 |
| GHSA-9wmc-988h-2mv2 | CVE-2024-50703 | CRITICAL | - |
TeamPass privileges issue |
2024-12-30 |
| GHSA-5pq7-52mg-hr42 | CVE-2024-22049 | MODERATE |
httparty has multipart/form-data request tampering vulnerability |
2024-01-05 | |
| GHSA-x6gm-qqwp-76gr | CVE-2022-30597 | MODERATE | - |
External Control of Assumed-Immutable Web Parameter in moodle |
2022-06-02 |