CWE-99 Improper Control of Resource Identifiers ('Resource Injection')
Description
The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-99 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-gjx6-h8hm-c9rq | CVE-2025-9264 | LOW |
xxl-job Jobs Handler remove function allows improper control of resource identifiers via ID parameter |
2026-05-07 | |
| GHSA-6rq7-m52p-8pqg | CVE-2025-9263 | LOW |
xxl-job Vulnerable to Resource Injection and Authorization Bypass Through User-Controlled Key |
2026-05-07 | |
| GHSA-gw2x-mfwr-h46p | CVE-2026-7303 | LOW |
xxl-job has a Resource Injection issue |
2026-05-06 | |
| GHSA-fqq7-h225-8w6h | CVE-2025-12918 | LOW | - |
Skuul School Management System has an Insecure Direct Object Reference (IDOR) Vulnerability in View Fee Invoice |
2025-12-12 |
| GHSA-c73g-mx2w-cc93 | CVE-2025-12919 | LOW |
EverShop is vulnerable to Unauthorized Order Information Access (IDOR) |
2025-11-13 | |
| GHSA-j327-c69h-4gh8 | CVE-2023-2980 | MODERATE |
Abstrium Pydio Cells Resource Injection vulnerability |
2023-11-16 | |
| GHSA-w29m-fjp4-qhmq | CVE-2020-5230 | MODERATE |
Unsafe Identifiers in Opencast |
2021-01-14 |