cve.bz

CWE-472: External Control of Assumed-Immutable Web Parameter, page 3

Filter

The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.

What the weakness is: CWE-472 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 4
  • CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies Likelihood: High · Severity: High
  • CAPEC-39 Manipulating Opaque Client-based Data Tokens Likelihood: High · Severity: Medium
  • CAPEC-146 XML Schema Poisoning Likelihood: Low · Severity: High
  • CAPEC-226 Session Credential Falsification through Manipulation Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-472, as MITRE names them. Credits.

Ask an AI about CWE-472

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-472: External Control of Assumed-Immutable Web Parameter and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/472.html and https://cve.bz/cve/cwe/472?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2026-5859EPSS 0.4%

    Integer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

  2. 8.2CVE-2026-39364ExploitEPSS 2.3%

    Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query param…

  3. 9.1CVE-2026-34751EPSS 0.3%

    Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on b…

  4. 7.5CVE-2026-5277EPSS 0.3%

    Integer overflow in ANGLE in Google Chrome on Windows prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity:…

  5. 8.8CVE-2026-5274EPSS 0.4%

    Integer overflow in Codecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

  6. 8.8CVE-2026-4679EPSS 0.3%

    Integer overflow in Fonts in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

  7. 8.8CVE-2026-4464EPSS 0.3%

    Integer overflow in ANGLE in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

  8. 4.3CVE-2026-4453EPSS 0.2%

    Integer overflow in Dawn in Google Chrome on Mac prior to 146.0.7680.153 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

  9. 8.8CVE-2026-4452EPSS 0.3%

    Integer overflow in ANGLE in Google Chrome on Windows prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  10. 8.8CVE-2026-3914EPSS 0.4%

    Integer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  11. 8.8CVE-2026-3538EPSS 0.8%

    Integer overflow in Skia in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Critical)

  12. 8.8CVE-2026-3536EPSS 0.7%

    Integer overflow in ANGLE in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Critical)

  13. 8.8CVE-2026-2649EPSS 0.6%

    Integer overflow in V8 in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  14. 8.7CVE-2025-14750EPSS 0.3%

    The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-privileged user can modify the parameters and potentially manipulate account-level privileges.

  15. 6.5CVE-2025-67846EPSS 0.4%

    The Deployment Infrastructure in Mintlify Platform before 2025-11-15 allows remote attackers to bypass security patches and execute downgrade attacks via predictable deployment identifiers on the Vercel preview domain. An attacker can iden…

  16. 9.4CVE-2025-66385EPSS 0.5%

    UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as admin) via the user-edit endpoint by supplying or modifying role_id or organisation…

  17. 8.8CVE-2025-10892EPSS 0.3%

    Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  18. 8.8CVE-2025-10891EPSS 8.7%

    Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  19. 5.3CVE-2025-54551EPSS 0.2%

    Synapse Mobility 8.0, 8.0.1, 8.0.2, 8.1, and 8.1.1 contain a privilege escalation vulnerability through external control of Web parameter. If exploited, a user of the product may escalate the privilege and access data that the user do not …

  20. 5.3CVE-2025-54832EPSS 0.4%

    OPEXUS FOIAXpress Public Access Link (PAL), version v11.1.0, allows an authenticated user to add entries to the list of states and territories.

  21. 7.5CVE-2025-8198EPSS 0.4%

    The MinimogWP – The High Converting eCommerce WordPress Theme theme for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.9.0. This is due to an insufficient check on quantity values when changing quanti…

  22. 8.8CVE-2025-7656EPSS 11%

    Integer overflow in V8 in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  23. 9.8CVE-2025-43933EPSS 0.4%

    fblog through 983bede allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header.

  24. 9.8CVE-2025-43930EPSS 0.5%

    Hashview 0.8.1 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header.

  25. 8.8CVE-2025-6191EPSS 12%

    Integer overflow in V8 in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

  26. 4.3CVE-2025-43002EPSS 0.3%

    SAP S4CORE OData meta-data property allows an authenticated attacker to access restricted information due to missing authorization check. This could cause a low impact on confidentiality but integrity and availability of the application ar…

  27. 8.8CVE-2025-47817EPSS 0.5%

    In BlueWave Checkmate through 2.0.2 before b387eba, a profile edit request can include a role parameter.

  28. 6.9CVE-2025-35939KEVEPSS 1.3%

    Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to th…

  29. 8.1CVE-2025-47245EPSS 0.5%

    In BlueWave Checkmate through 2.0.2 before d4a6072, an invite request can be modified to specify a privileged role.

  30. 5.3CVE-2025-3743EPSS 0.4%

    The Upsell Funnel Builder for WooCommerce plugin for WordPress is vulnerable to order manipulation in all versions up to, and including, 3.0.0. This is due to the plugin allowing the additional product ID and discount field to be manipulat…

  31. 7.5CVE-2025-3530EPSS 0.5%

    The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to product price manipulation in all versions up to, and including, 5.1.2. This is due to a logic flaw involving the inconsistent use of parameters during the cart addit…

  32. 4.3CVE-2025-31327EPSS 0.3%

    SAP Field Logistics Manage Logistics application OData meta-data property is vulnerable to data tampering, due to which certain fields could be externally modified by an attacker causing low impact on integrity of the application. Confiden…

  33. 3.1CVE-2025-32816EPSS 0.3%

    CodeLit CourseLit before 0.57.5 allows Parameter Tampering via a payment plan associated with the wrong entity.

  34. 4.3CVE-2025-31333EPSS 0.3%

    SAP S4CORE OData meta-data property is vulnerable to data tampering, due to which entity set could be externally modified by an attacker causing low impact on integrity of the application. Confidentiality and availability is not impacted.

  35. 6.5CVE-2025-30152EPSS 0.4%

    The Syliud PayPal Plugin is the Sylius Core Team’s plugin for the PayPal Commerce Platform. Prior to 1.6.2, 1.7.2, and 2.0.2, a discovered vulnerability allows users to modify their shopping cart after completing the PayPal Checkout proces…

  36. 8.6CVE-2025-30236EPSS 0.4%

    Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six-digit TOTP code (skipping a password check) if an HTTP POST request contains a SESSION parameter.

  37. 6.5CVE-2025-29788EPSS 0.5%

    The Syliud PayPal Plugin is the Sylius Core Team’s plugin for the PayPal Commerce Platform. A vulnerability in versions prior to 1.6.1, 1.7.1, and 2.0.1 allows users to manipulate the final payment amount processed by PayPal. If a user mod…

  38. 5.3CVE-2025-26312EPSS 0.3%

    SendQuick Entera devices before 11HF5 are vulnerable to CAPTCHA bypass by removing the Captcha parameter.

  39. 4.3CVE-2025-27893EPSS 0.4%

    In Archer Platform 6 through 6.14.00202.10024, an authenticated user with record creation privileges can manipulate immutable fields, such as the creation date, by intercepting and modifying a Copy request via a GenericContent/Record.aspx?…

  40. 7.5CVE-2025-25382EPSS 0.3%

    An issue in the Property Tax Payment Portal in Information Kerala Mission SANCHAYA v3.0.4 allows attackers to arbitrarily modify payment amounts via a crafted request.

  41. 8.8CVE-2025-0436EPSS 0.6%

    Integer overflow in Skia in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  42. 7.5CVE-2025-22384EPSS 0.4%

    An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in spec…

  43. 8.1CVE-2024-50703EPSS 0.5%

    TeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different user_id.

  44. 5.3CVE-2024-12123EPSS 0.4%

    A hidden field manipulation vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user.  When an authenticated user submits a ticket, the request can be intercepted and subsequently modified by…

  45. 8.8CVE-2024-7025EPSS 0.7%

    Integer overflow in Layout in Google Chrome prior to 129.0.6668.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  46. 8.8CVE-2024-9123EPSS 0.5%

    Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

  47. 5.3CVE-2024-6010EPSS 0.4%

    The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This is due to the plugin allowing the price field to be manipulated prior to processing via the 'create_…

  48. 6.5CVE-2023-38520EPSS 0.4%

    External Control of Assumed-Immutable Web Parameter vulnerability in PINPOINT.WORLD Pinpoint Booking System allows Functionality Misuse.This issue affects Pinpoint Booking System: from n/a through 2.9.9.3.4.

  49. 9.8CVE-2023-24373EPSS 0.4%

    External Control of Assumed-Immutable Web Parameter vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Manipulating Hidden Fields.This issue affects Booking calendar, Appointment Booking System: from n/a through …

  50. 5.3CVE-2024-3649EPSS 0.7%

    The Contact Form by WPForms – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to price manipulation in versions up to, and including, 1.8.7.2. This is due to a lack of controls on several product parameters. This …