CWE-15 · Misconfiguration and Insecure Design
External Control of System or Configuration Setting
93CVEs
0exploited
1with a public check
4likely (EPSS 10%+)
SortMost likely exploited
93 CVEs with CWE-15 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-43323CheckmooSocial 3.1.8 - External Service InteractionMoosocial · Moosocial · 2023-09-28 | – | 2.1% | 2023-09-28 |
| CVE-2024-39280An external config control vulnerability exists in the nas.cgi set_smb_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbit…Wavlink · Wavlink AC3000 · CVSS 9.1 · 2025-01-14 | 9.1 | 35% | 2025-01-14 |
| CVE-2023-50252php-svg-lib unsafe attributes merge when parsing `use` tagdompdf · php-svg-lib · CVSS 8.3 · 2023-12-12 | 8.3 | 25% | 2023-12-12 |
| CVE-2024-38666An external config control vulnerability exists in the openvpn.cgi openvpn_client_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can…Wavlink · Wavlink AC3000 · CVSS 9.1 · 2025-01-14 | 9.1 | 19% | 2025-01-14 |
| CVE-2024-51544Service ControlABB · ASPECT-Enterprise · CVSS 8.2 · 2024-12-05 | 8.2 | 13% | 2024-12-05 |
| CVE-2026-45087Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Modehahwul · dalfox · CVSS 10 · 2026-05-27 | 10.0 | 8.7% | 2026-05-27 |
| CVE-2024-10979PostgreSQL PL/Perl environment variable changes execute arbitrary codePostgresql · PostgreSQL · CVSS 8.8 · 2024-11-14 | 8.8 | 4.4% | 2024-11-14 |
| CVE-2024-39602An external config control vulnerability exists in the nas.cgi set_nas() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary…Wavlink · Wavlink AC3000 · CVSS 9.1 · 2025-01-14 | 9.1 | 2.4% | 2025-01-14 |
| CVE-2024-39800Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP requ…Wavlink · Wavlink AC3000 · CVSS 9.1 · 2025-01-14 | 9.1 | 1.9% | 2025-01-14 |
| CVE-2024-39798Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP requ…Wavlink · Wavlink AC3000 · CVSS 9.1 · 2025-01-14 | 9.1 | 1.9% | 2025-01-14 |
| CVE-2024-39795Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can le…Wavlink · Wavlink AC3000 · CVSS 9.1 · 2025-01-14 | 9.1 | 1.6% | 2025-01-14 |
| CVE-2024-39793Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can le…Wavlink · Wavlink AC3000 · CVSS 9.1 · 2025-01-14 | 9.1 | 1.6% | 2025-01-14 |
| CVE-2024-39790Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead t…Wavlink · Wavlink AC3000 · CVSS 9.1 · 2025-01-14 | 9.1 | 1.6% | 2025-01-14 |
| CVE-2024-39788Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead t…Wavlink · Wavlink AC3000 · CVSS 9.1 · 2025-01-14 | 9.1 | 1.6% | 2025-01-14 |
| CVE-2021-3707D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to unauthorized configuration modification. An unauthenticated attacker on the local network may expl…D-Link · DSL-2750U · 2021-08-16 | – | 1.5% | 2021-08-16 |
| CVE-2024-39799Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP requ…Wavlink · Wavlink AC3000 · CVSS 9.1 · 2025-01-14 | 9.1 | 1.3% | 2025-01-14 |
| CVE-2023-46248Overwrite of builtin Cody commands facilitates RCEsourcegraph · cody · CVSS 9.1 · 2023-10-31 | 9.1 | 1.3% | 2023-10-31 |
| CVE-2021-27406PerFact OpenVPN-ClientPerFact · OpenVPN-Client · CVSS 8.8 · 2022-10-14 | 8.8 | 1.2% | 2022-10-14 |
| CVE-2024-39794Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can le…Wavlink · Wavlink AC3000 · CVSS 9.1 · 2025-01-14 | 9.1 | 1.1% | 2025-01-14 |
| CVE-2024-39789Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead t…Wavlink · Wavlink AC3000 · CVSS 9.1 · 2025-01-14 | 9.1 | 1.1% | 2025-01-14 |
| CVE-2023-32349Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter parameters. However, variables for validat…Teltonika · RUT model routers · CVSS 8 · 2023-05-22 | 8.0 | 1.1% | 2023-05-22 |
| CVE-2021-38453AUVESY VersiondogAUVESY · Versiondog · CVSS 9.1 · 2021-10-22 | 9.1 | 1.1% | 2021-10-22 |
| CVE-2024-4326Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webuiparisneo · parisneo/lollms-webui · CVSS 9.8 · 2024-05-16 | 9.8 | 1.0% | 2024-05-16 |
| CVE-2025-41452Post auth nginx configuration injection in Danfoss AK-SM8xxA SeriesDanfoss · AK-SM8xxA Series · CVSS 6.8 · 2025-08-22 | 6.8 | 0.9% | 2025-08-22 |
| CVE-2023-4704External Control of System or Configuration Setting in instantsoft/icms2instantsoft · instantsoft/icms2 · CVSS 8.8 · 2023-09-01 | 8.8 | 0.9% | 2023-09-01 |
| CVE-2026-118208Microsoft Exchange Server Spoofing VulnerabilityMicrosoft · Microsoft Exchange Server Subscription Edition RTM · CVSS 7.1 · 2026-11-10 | 7.1 | 0.8% | 2026-11-10 |
| CVE-2026-22708Cursor has a Terminal Tool Allowlist Bypass via Environment Variablescursor · cursor · CVSS 7.2 · 2026-01-14 | 7.2 | 0.8% | 2026-01-14 |
| CVE-2025-30512Growatt Cloud portal External Control of System or Configuration SettingGrowatt · Cloud portal · CVSS 6.5 · 2025-04-15 | 6.5 | 0.7% | 2025-04-15 |
| CVE-2024-21583Versions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/components/ws-proxy/pkg…github.com/gitpod-io/gitpod/components/server/go/pkg/lib · CVSS 4.1 · 2024-07-19 | 4.1 | 0.6% | 2024-07-19 |
| CVE-2022-41582The security module has configuration defects.Successful exploitation of this vulnerability may affect system availability.Huawei · HarmonyOS · CVSS 7.5 · 2022-10-14 | 7.5 | 0.6% | 2022-10-14 |
| CVE-2026-87987An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted comma…mistralai · mistral-vibe · CVSS 10 · 2026-09-11 | 10.0 | 0.6% | 2026-09-11 |
| CVE-2026-96218Windows Update Stack Tampering VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 5.5 · 2026-10-13 | 5.5 | 0.6% | 2026-10-13 |
| CVE-2024-50358A CWE-15 "External Control of System or Configuration Setting" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (…Advantech · EKI-6333AC-2G · CVSS 7.2 · 2024-11-26 | 7.2 | 0.5% | 2024-11-26 |
| CVE-2026-19593OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with…OpenAI · Codex Desktop · CVSS 9.8 · 2026-09-01 | 9.8 | 0.5% | 2026-09-01 |
| CVE-2026-73027Windows Setup Files Cleanup Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 7.8 · 2026-10-13 | 7.8 | 0.5% | 2026-10-13 |
| CVE-2025-27889Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link. If a user clicks…wftpserver · Wing FTP Server · CVSS 3.4 · 2025-07-10 | 3.4 | 0.5% | 2025-07-10 |
| CVE-2026-35650OpenClaw < 2026.3.22 - Environment Variable Override Bypass via Inconsistent SanitizationOpenClaw · OpenClaw · CVSS 7.5 · 2026-04-10 | 7.5 | 0.5% | 2026-04-10 |
| CVE-2026-106152External Control of Configuration Setting in Telerik Report ServerProgress Software · Telerik Report Server · CVSS 8.8 · 2026-11-11 | 8.8 | 0.5% | 2026-11-11 |
| CVE-2026-16708IBM Db2 Mirror for i is affected by multiple vulnerabilitiesIBM · Db2 Mirror for i · CVSS 8.3 · 2026-08-14 | 8.3 | 0.4% | 2026-08-14 |
| CVE-2026-88266An external control of system or configuration setting vulnerability in the synomount in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote au…Synology · DiskStation Manager (DSM) · CVSS 4.3 · 2026-11-12 | 4.3 | 0.4% | 2026-11-12 |
| CVE-2026-22177OpenClaw < 2026.2.21 - Environment Variable Injection via Config env.varsOpenClaw · OpenClaw · CVSS 6.1 · 2026-03-18 | 6.1 | 0.4% | 2026-03-18 |
| CVE-2026-54918NetBox Device Type Library: PR-controllable upstream clone URL (NETBOX_DT_LIBRARY_URL) enables SSRF and test-data substitution from CInetbox-community · devicetype-library · CVSS 5.3 · 2026-09-17 | 5.3 | 0.4% | 2026-09-17 |
| CVE-2019-25716Dräger Infinity Delta/Kappa Patient Monitor DoS via Malformed Network PacketDräger · Infinity Delta · CVSS 6.5 · 2026-06-01 | 6.5 | 0.4% | 2026-06-01 |
| CVE-2023-46764Unauthorized startup vulnerability of background apps. Successful exploitation of this vulnerability may cause background apps to start maliciously.Huawei · HarmonyOS · 2023-11-08 | – | 0.4% | 2023-11-08 |
| CVE-2026-27203eBay API MCP Server Affected by Environment Variable InjectionYosefHayim · ebay-mcp · CVSS 8.3 · 2026-02-20 | 8.3 | 0.4% | 2026-02-20 |
| CVE-2026-107818MariaDB: environment injection via wsrep bootstrap in the mariadb.service fileMariaDB · server · CVSS 8.4 · 2026-10-09 | 8.4 | 0.4% | 2026-10-09 |
| CVE-2026-46485Dash: Users can write to config despire permissions (OIDC tested)lissy93 · dashy · CVSS 8.2 · 2026-07-15 | 8.2 | 0.4% | 2026-07-15 |
| CVE-2026-96188Microsoft PowerToys Elevation of Privilege VulnerabilityMicrosoft · Microsoft PowerToys · CVSS 7.3 · 2026-10-13 | 7.3 | 0.4% | 2026-10-13 |
| CVE-2023-3321Code Execution through Writable Mosquitto Configuration FileABB · ABB Ability™ zenon · CVSS 7 · 2023-07-24 | 7.0 | 0.4% | 2023-07-24 |
| CVE-2025-8283Netavark: podman: netavark may resolve hostnames to unexpected hostsRedhat · netavark · CVSS 3.7 · 2025-07-28 | 3.7 | 0.4% | 2025-07-28 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.