cve.bz

CWE-914: Improper Control of Dynamically-Identified Variables

Filter

The product does not properly restrict reading from or writing to dynamically-identified variables.

What the weakness is: CWE-914 at MITRE. All weaknesses

Ask an AI about CWE-914

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-914: Improper Control of Dynamically-Identified Variables and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/914.html and https://cve.bz/cve/cwe/914?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.3CVE-2019-25777EPSS 0.4%

    YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it…

  2. 10.0CVE-2026-44006EPSS 0.8%

    vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.

  3. 6.5CVE-2026-35173EPSS 0.2%

    Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, an IDOR / Mass Assignment issue exists in the Post model that allows authenticated users with post editing permissions (Edit Post, Edit Draft, Edit Own Post, Edit Own Dr…

  4. 7.9CVE-2026-34444EPSS 0.6%

    Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypa…

  5. 2.1CVE-2025-14085EPSS 0.4%

    A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0. This impacts an unknown function of the file /app-api/v1/orders/. The manipulation of the argument orderId leads to improper control of dynamically-identified variables.…

  6. 2.1CVE-2025-14051EPSS 0.5%

    A flaw has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function getById/updateAddress/deleteAddress of the file /mall-ums/app-api/v1/addresses/. Executing manipulation can lead to improper control of dynamically-ident…

  7. 8.5CVE-2024-54198EPSS 0.6%

    In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be used to expose credentials for a remote service. These cre…

  8. 8.0CVE-2024-24914EPSS 0.4%

    Authenticated Gaia users can inject code or commands by global variables through special HTTP requests. A Security fix that mitigates this vulnerability is available.

  9. 7.5CVE-2023-33175EPSS 0.7%

    ToUI is a Python package for creating user interfaces (websites and desktop apps) from HTML. ToUI is using Flask-Caching (SimpleCache) to store user variables. Websites that use `Website.user_vars` property. It affects versions 2.0.1 to 2.…