Common Weakness Enumeration
CWE-830 Inclusion of Web Functionality from an Untrusted Source
Description
The product includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-830 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-6xvf-4vh9-mw47 | - | HIGH |
Minder does not sandbox http.send in Rego programs |
2025-11-20 | |
| GHSA-cm35-v4vp-5xvx | CVE-2025-64496 | HIGH |
Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events |
2025-11-15 | |
| GHSA-vr85-5pwx-c6gq | CVE-2024-35180 | MODERATE |
OMERO.web must check that the JSONP callback is a valid function |
2024-05-21 |