CWE-233 · Input Validation and Logic
Improper Handling of Parameters
32CVEs
SortMost likely exploited
32 CVEs with CWE-233 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-52970CheckFortinet FortiWeb - Authentication Bypass to Admin PrivilegeFortinet · FortiWeb · CVSS 7.7 · 2025-08-12 | 7.7 | 9.3% | 2025-08-12 |
| CVE-2021-1230Cisco Nexus 9000 Series Fabric Switches ACI Mode BGP Route Installation Denial of Service VulnerabilityCisco · Cisco NX-OS System Software in ACI Mode · CVSS 8.6 · 2021-02-24 | 8.6 | 1.5% | 2021-02-24 |
| CVE-2023-20076Cisco IOx Application Hosting Environment Command Injection VulnerabilityCisco · Cisco IOS · CVSS 7.2 · 2023-02-12 | 7.2 | 1.5% | 2023-02-12 |
| CVE-2022-45182Pi-Star_DV_Dash (for Pi-Star DV) before 5aa194d mishandles the module parameter.Pistar · Pi-Star Digital Voice Dashboard · CVSS 9.8 · 2022-11-11 | 9.8 | 1.2% | 2022-11-11 |
| CVE-2024-24525An issue in EpointWebBuilder 5.1.0-sp1, 5.2.1-sp1, 5.4.1 and 5.4.2 allows a remote attacker to execute arbitrary code via the infoid parameter of the URL.Epoint · Epointwebbuilder · CVSS 9.8 · 2024-02-29 | 9.8 | 1.1% | 2024-02-29 |
| CVE-2024-31808TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the webWlanIdx parameter in the setWebWlanIdx function.Totolink · Ex200 Firmware · CVSS 8.8 · 2024-04-08 | 8.8 | 0.9% | 2024-04-08 |
| CVE-2021-0269Junos OS: J-Web can be compromised through reflected client-side HTTP parameter pollution attacks.Juniper Networks · Junos OS · CVSS 8.8 · 2021-04-22 | 8.8 | 0.9% | 2021-04-22 |
| CVE-2022-3697A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take adva…Redhat · ansible, ansible community.aws, ansible amazon.aws · 2022-10-28 | – | 0.9% | 2022-10-28 |
| CVE-2022-32261A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a misconfiguration in the APT update. This could allow…Siemens · SINEMA Remote Connect Server · CVSS 5.3 · 2022-06-14 | 5.3 | 0.7% | 2022-06-14 |
| CVE-2024-9329Glassfish redirect to untrusted siteEclipse Foundation · Glassfish · CVSS 6.9 · 2024-09-30 | 6.9 | 0.7% | 2024-09-30 |
| CVE-2024-33433Cross Site Scripting vulnerability in TOTOLINK X2000R before v1.0.0-B20231213.1013 allows a remote attacker to execute arbitrary code via the Guest Access Control parameter in the…Totolink · X2000r Firmware · CVSS 4.8 · 2024-05-13 | 4.8 | 0.6% | 2024-05-13 |
| CVE-2022-22792MobiSoft - MobiPlus User Take Over and Improper Handling of url ParametersMobiSoft · eharmony · CVSS 6.6 · 2022-02-16 | 6.6 | 0.6% | 2022-02-16 |
| CVE-2024-25979Msa-24-0002: forum search accepted random parameters in its urlMoodle · Moodle · CVSS 5.3 · 2024-02-19 | 5.3 | 0.6% | 2024-02-19 |
| CVE-2021-45478IDOR in Yordam Library Automation SystemYordam Information Technologies · Library Automation System · CVSS 6.5 · 2023-03-02 | 6.5 | 0.6% | 2023-03-02 |
| CVE-2021-45477IDOR in Yordam Library Automation SystemYordam Information Technologies · Library Automation System · CVSS 6.5 · 2023-03-02 | 6.5 | 0.6% | 2023-03-02 |
| CVE-2026-32998This vulnerability in Veeam Service Provider Console allows for remote code execution.Veeam · Service Provider Console · CVSS 9.4 · 2026-05-28 | 9.4 | 0.5% | 2026-05-28 |
| CVE-2026-2370Improper Handling of Parameters in GitLabGitLab · GitLab · CVSS 8.1 · 2026-03-29 | 8.1 | 0.4% | 2026-03-29 |
| CVE-2023-26549The SystemUI module has a vulnerability of repeated app restart due to improper parameters. Successful exploitation of this vulnerability may affect confidentiality.Huawei · HarmonyOS · 2023-03-27 | – | 0.4% | 2023-03-27 |
| CVE-2026-22626Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can cause abnormal device behavior by crafting specific messag…HIKSEMI · HS-AFS-S1H1 · CVSS 4.9 · 2026-01-30 | 4.9 | 0.4% | 2026-01-30 |
| CVE-2026-55835Lookyloo: Potential sub-system DoS due to parameter missmatch in notificationLookyloo · lookyloo · CVSS 6.9 · 2026-10-23 | 6.9 | 0.4% | 2026-10-23 |
| CVE-2023-1419Debezium: script injection via connector parameterRed Hat · Red Hat build of Debezium · CVSS 5.9 · 2024-11-17 | 5.9 | 0.4% | 2024-11-17 |
| CVE-2020-10069Zephyr Bluetooth unchecked packet data results in denial of servicezephyrproject-rtos · zephyr · CVSS 4.3 · 2021-05-24 | 4.3 | 0.4% | 2021-05-24 |
| CVE-2023-40819ID4Portais in version < V.2022.837.002a returns message parameter unsanitized in the response, resulting in a HTML Injection vulnerability.Devlop.systems · Id4portais · CVSS 6.1 · 2024-08-06 | 6.1 | 0.3% | 2024-08-06 |
| CVE-2023-28898Head Unit Denial-of-Service via Apple CarPlay serviceJOYNEXT · MIB3 Infotainment Unit · CVSS 5.3 · 2024-01-12 | 5.3 | 0.2% | 2024-01-12 |
| CVE-2018-25233WebDrive 18.00.5057 Denial of Service via Secure WebDAVWebdrive · WebDrive · CVSS 6.2 · 2026-03-30 | 6.2 | 0.2% | 2026-03-30 |
| CVE-2024-20306A vulnerability in the Unified Threat Defense (UTD) configuration CLI of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary commands as root o…Cisco · Cisco IOS XE Software · CVSS 6 · 2024-03-27 | 6.0 | 0.2% | 2024-03-27 |
| CVE-2025-55078Incomplete validation of kernel object pointers in system callsEclipse Foundation · ThreadX · CVSS 5.7 · 2025-10-14 | 5.7 | 0.2% | 2025-10-14 |
| CVE-2023-7261Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to perform privilege escalation via a malicious file. (Chromium securi…Google · Omaha · CVSS 7.3 · 2024-06-07 | 7.3 | 0.2% | 2024-06-07 |
| CVE-2023-20514Improper handling of parameters in the AMD Secure Processor (ASP) could allow a privileged attacker to pass an arbitrary memory value to functions in the trusted execution environ…AMD · AMD Radeon™ RX 6000 Series Graphics Products · CVSS 8.7 · 2026-02-11 | 8.7 | 0.2% | 2026-02-11 |
| CVE-2026-0515Insufficient parameter validation in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for SafetyBlackBerry Ltd · QNX Software Development Platform · CVSS 6.2 · 2026-07-14 | 6.2 | 0.1% | 2026-07-14 |
| CVE-2025-55080Improper Parameter Check in ThreadX Syscall ImplementationEclipse Foundation · ThreadX · CVSS 7.2 · 2025-10-15 | 7.2 | 0.1% | 2025-10-15 |
| CVE-2026-33585Arqit SKA-Platform Improper Handling of Parameters VulnerabilityArqit · Symmetric Key Agreement Platform · CVSS 3.8 · 2026-05-13 | 3.8 | 0.1% | 2026-05-13 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.