CWE-233 · weakness in Input Validation and Logic
Improper Handling of Parameters
32 CVEs
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- check available
- 1
Every one of the 32 is a mark on the map. Named now: 1 to 26, most at risk first.
- Fortinet FortiWeb - Authentication Bypass to Admin Privilege
- Cisco Nexus 9000 Series Fabric Switches ACI Mode BGP Route Installation Denial of Service Vulnerability
- Cisco IOx Application Hosting Environment Command Injection Vulnerability
- Pi-Star_DV_Dash (for Pi-Star DV) before 5aa194d mishandles the module parameter.
- An issue in EpointWebBuilder 5.1.0-sp1, 5.2.1-sp1, 5.4.1 and 5.4.2 allows a remote attacker to execute arbitrary code via the infoid parameter of the URL.
- TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the webWlanIdx parameter in the setWebWlanIdx function.
- Junos OS: J-Web can be compromised through reflected client-side HTTP parameter pollution attacks.
- A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take adva…
- A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a misconfiguration in the APT update. This could allow…
- Glassfish redirect to untrusted site
- Cross Site Scripting vulnerability in TOTOLINK X2000R before v1.0.0-B20231213.1013 allows a remote attacker to execute arbitrary code via the Guest Access Control parameter in the…
- MobiSoft - MobiPlus User Take Over and Improper Handling of url Parameters
- Msa-24-0002: forum search accepted random parameters in its url
- IDOR in Yordam Library Automation System
- IDOR in Yordam Library Automation System
- This vulnerability in Veeam Service Provider Console allows for remote code execution.
- Improper Handling of Parameters in GitLab
- The SystemUI module has a vulnerability of repeated app restart due to improper parameters. Successful exploitation of this vulnerability may affect confidentiality.
- Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can cause abnormal device behavior by crafting specific messag…
- Lookyloo: Potential sub-system DoS due to parameter missmatch in notification
- Debezium: script injection via connector parameter
- Zephyr Bluetooth unchecked packet data results in denial of service
- ID4Portais in version < V.2022.837.002a returns message parameter unsanitized in the response, resulting in a HTML Injection vulnerability.
- Head Unit Denial-of-Service via Apple CarPlay service
- WebDrive 18.00.5057 Denial of Service via Secure WebDAV
- A vulnerability in the Unified Threat Defense (UTD) configuration CLI of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary commands as root o…
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.