CWE-914 · Deserialization and Object Injection
Improper Control of Dynamically-Identified Variables
6CVEs
0exploited
0with a public check
0likely (EPSS 10%+)
SortMost likely exploited
6 CVEs with CWE-914 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-33175ToUI allows user-specific variables to be shared between usersmubarakalmehairbi · ToUI · CVSS 9.1 · 2023-05-30 | 9.1 | 0.7% | 2023-05-30 |
| CVE-2024-54198Information Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAPSAP_SE · SAP NetWeaver Application Server ABAP · CVSS 8.5 · 2024-12-10 | 8.5 | 0.6% | 2024-12-10 |
| CVE-2025-14051youlaitech youlai-mall addresses deleteAddress improper control of dynamically-identified variablesyoulaitech · youlai-mall · CVSS 6.3 · 2025-12-04 | 6.3 | 0.5% | 2025-12-04 |
| CVE-2025-14085youlaitech youlai-mall orders improper control of dynamically-identified variablesyoulaitech · youlai-mall · CVSS 6.3 · 2025-12-05 | 6.3 | 0.4% | 2025-12-05 |
| CVE-2024-24914Authenticated Gaia users can inject code or commands by global variables through special HTTP requests. A Security fix that mitigates this vulnerability is available.checkpoint · ClusterXL, Multi-Domain Security Management, Quantum Appliances, Quantum Maestr… · CVSS 8 · 2024-11-07 | 8.0 | 0.4% | 2024-11-07 |
| CVE-2019-25777YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code executionNo vendor recorded · CVSS 7.3 · 2026-10-05 | 7.3 | 0.4% | 2026-10-05 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.