CWE-830: Inclusion of Web Functionality from an Untrusted Source

The product includes web functionality (such as a web widget) from another domain in a way that causes the functionality to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source.

What the weakness is: CWE-830 at MITRE. OWASP Top 10: A08:2025 Software or Data Integrity Failures

1. 7.5CVE-2025-61478EPSS 0.5%2026-08-26

   An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via Spoofed SYN packets.

2. 8.5CVE-2025-65109EPSS 0.3%2025-11-21

   Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which ma…

3. 8.0CVE-2025-64496EPSS 7.2%2025-11-08

   Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model ser…

4. 6.1CVE-2025-46652EPSS 0.3%2025-04-26

   In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an extraction from an archive file that bears Mark-of-the-Web, Mark-of-the-Web is not propagated to the extracted files. NOTE: this is disputed bec…

5. 5.4CVE-2025-43703EPSS 0.2%2025-04-16

   An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API (even though the attacker has no knowledge of an API key) through approaches such as scripts or the…

6. 6.1CVE-2025-33028EPSS 0.5%2025-04-15

   In WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete fix for CVE-2024-8811. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of Win…

7. 7.8CVE-2025-33027EPSS 0.3%2025-04-15

   In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of Bandizip. User interaction is required…

8. 7.8CVE-2025-33026EPSS 0.3%2025-04-15

   In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of PeaZip. User interaction is required to exploit …

9. 8.3CVE-2024-42381EPSS 0.6%2024-07-31

   os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve code execution via an ELF file with a custom .interp section. NOTE: this code execution would occu…

10. 6.1CVE-2024-35180EPSS 0.3%2024-05-21

    OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. This vulnerability has bee…

11. 8.4CVE-2024-29944EPSS 4.7%2024-03-22

    An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, it does not affect mobile versions of Fi…

12. 8.8CVE-2023-2588EPSS 1.1%2023-05-22

    Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing users to access managed devices’ local secure shell (SSH)/web management services over the cloud proxy. A user can request a web proxy and obtain a URL i…

13. 6.1CVE-2021-28162EPSS 0.8%2021-03-12

    In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.