CWE-472

External Control of Assumed-Immutable Web Parameter

Parent: CWE-642 - External Control of Critical State Data

The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.

75 vulnerabilities with CWE-472
CVE-2026-7340 MEDIUM
Google Chrome < 147.0.7727.138 - Out-of-Bounds Access
CVSS 4.3
CVE-2026-4911 MEDIUM
Booking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter
CVSS 5.3
CVE-2026-41353 HIGH
OpenClaw < 2026.3.22 - allowProfiles Bypass via Profile Mutation and Runtime Selection
CVSS 8.1
CVE-2026-2519 MEDIUM
Online Scheduling and Appointment Booking System – Bookly <= 27.0 - Unauthenticated Price Manipulation via 'tips'
CVSS 5.3
CVE-2026-5912 HIGH
Google Chrome < 147.0.7727.55 - Out-of-Bounds Access
CVSS 8.8
CVE-2026-5910 HIGH
Google Chrome <147.0.7727.55 - Memory Corruption
CVSS 8.8
CVE-2026-5909 HIGH
Google Chrome <147.0.7727.55 - Memory Corruption
CVSS 8.8
CVE-2026-5908 HIGH
Google Chrome <147.0.7727.55 - Memory Corruption
CVSS 8.8
CVE-2026-5870 HIGH
Google Chrome <147.0.7727.55 - Memory Corruption
CVSS 8.8
CVE-2026-5859 HIGH
Google Chrome <147.0.7727.55 - Memory Corruption
CVSS 8.8
CVE-2026-34751 CRITICAL
Payload has Unvalidated Input in Password Recovery Endpoints
CVSS 9.1
CVE-2026-5277 HIGH
Google Chrome < 146.0.7680.178 - Out-of-Bounds Access
CVSS 7.5
CVE-2026-5274 HIGH
Google Chrome <146.0.7680.178 - Memory Corruption
CVSS 8.8
CVE-2026-4679 HIGH
Google Chrome < 146.0.7680.165 - Out-of-Bounds Access
CVSS 8.8
CVE-2026-4464 HIGH
Google Chrome <146.0.7680.153 - Memory Corruption
CVSS 8.8
CVE-2026-4453 MEDIUM
Google Chrome <146.0.7680.153 - Info Disclosure
CVSS 4.3
CVE-2026-4452 HIGH
Google Chrome <146.0.7680.153 - Memory Corruption
CVSS 8.8
CVE-2026-3914 HIGH
Google Chrome <146.0.7680.71 - Memory Corruption
CVSS 8.8
CVE-2026-3538 HIGH
Google Chrome <145.0.7632.159 - Memory Corruption
CVSS 8.8
CVE-2026-3536 HIGH
Google Chrome <145.0.7632.159 - Memory Corruption
CVSS 8.8
CVE-2026-2649 HIGH
Google Chrome <145.0.7632.109 - Memory Corruption
CVSS 8.8
CVE-2025-14750 HIGH
Web App - Privilege Escalation
CVE-2025-67846 MEDIUM
Mintlify Platform <2025-11-15 - Auth Bypass
CVSS 4.9
CVE-2025-66385 CRITICAL
Cerebrate <1.30 - Privilege Escalation
CVE-2025-10892 HIGH
Google Chrome < 140.0.7339.207 - Integer Overflow
CVSS 8.8
Details
Vulnerabilities 75
Links
MITRE CWE Entry Search this CWE With Exploits