cve.bz

CWE-473: PHP External Variable Modification

Filter

A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise.

What the weakness is: CWE-473 at MITRE. All weaknesses

Related attack patterns (CAPEC): 1
  • CAPEC-77 Manipulating User-Controlled Variables Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-473, as MITRE names them. Credits.

Ask an AI about CWE-473

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-473: PHP External Variable Modification and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/473.html and https://cve.bz/cve/cwe/473?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2026-40285EPSS 0.3%

    WeGIA is a web manager for charitable institutions. Versions prior to 3.6.10 contain a SQL injection vulnerability in dao/memorando/UsuarioDAO.php. The cpf_usuario POST parameter overwrites the session-stored user identity via extract($_RE…

  2. 9.8CVE-2026-28411ExploitEPSS 2.7%

    WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, an unsafe use of the `extract()` function on the `$_REQUEST` superglobal allows an unauthenticated attacker to overwrite local variables in multiple PHP scripts. T…

  3. 7.5CVE-2024-27489EPSS 0.4%

    An issue in the DelFile() function of WMCMS v4.4 allows attackers to delete arbitrary files via a crafted POST request.

  4. 9.8CVE-2023-36845KEVExploitEPSS 95%

    A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. Using a crafted request which sets the va…

  5. 5.3CVE-2023-36844KEVExploitEPSS 90%

    A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attack…