CWE-942

Permissive Cross-domain Security Policy with Untrusted Domains

Parent: CWE-863 - Incorrect Authorization

The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

115 vulnerabilities with CWE-942
CVE-2026-25478 HIGH
Litestar < 2.20.0 - Permissive Cross-domain Security Policy via Unescaped Regex Metacharacters
CVSS 7.4
CVE-2026-24435 MEDIUM
Shenzhen Tenda W30E V2 <16.01.0.19(5037) - XSS
CVSS 6.5
CVE-2026-1181 CRITICAL
Altium 365 - Improper Access Control via Overly Permissive CORS Policy
CVSS 9.0
CVE-2026-22812 HIGH
OpenCode <1.0.216 - Command Injection
CVSS 8.8
CVE-2025-55274 LOW
HCL Aftermarket DPC is affected by Cross-Origin Resource Sharing vulnerability
CVSS 2.6
CVE-2025-9292 HIGH
TP-Link Omada Cloud Controller - Permissive Cross-domain Security Policy with Untrusted Domains
CVSS 7.5
CVE-2025-13984 MEDIUM
Drupal Next.Js < 1.6.4 and 2.0.0 - Cross-Site Scripting via Permissive Cross-domain Security Policy
CVSS 6.1
CVE-2025-55462 MEDIUM
Eramba Community/Enterprise <3.26.0 - SSRF
CVSS 6.5
CVE-2025-13019 HIGH
Firefox < 140.5.0 and 140.5-140.* and < 145.0 and >=145 - Same-Origin Policy Bypass in DOM Workers
CVSS 8.1
CVE-2025-13017 HIGH
Firefox < 140.5.0 and 140.5-140.* and < 145.0 and >=145 - Same-Origin Policy Bypass via Notifications Component
CVSS 8.1
CVE-2025-43480 HIGH
Safari < 26.1 - Cross-Origin Data Exfiltration via Permissive Security Policy
CVSS 8.1
CVE-2025-43392 MEDIUM
Safari < 26.1 - Cross-Origin Image Data Exfiltration via Cache Handling
CVSS 4.3
CVE-2025-62523 MEDIUM
PILOS < 4.8.0 - Cross-Origin Resource Sharing Misconfiguration via Origin Header Reflection
CVSS 6.3
CVE-2025-53092 MEDIUM
Strapi < 5.20.0 - CORS Misconfiguration via Origin Header Reflection
CVSS 6.5
CVE-2025-11304 MEDIUM
CodeCanyon/ui-lib Mentor LMS <1.1.1 - XSS
CVSS 6.3
CVE-2025-41010 MEDIUM
Hiberus Sintra - Permissive Cross-domain Security Policy with Untrusted Domains
CVE-2025-10529 MEDIUM
Firefox < 140.3.0 and 140.3-140.* - Same-Origin Policy Bypass in Layout Component
CVSS 6.5
CVE-2025-57755 HIGH
musistudio claude-code-router < 1.0.34 - Exposure of Sensitive Information via Improper CORS Configuration
CVE-2025-27909 MEDIUM
IBM Concert 1.0.0-1.1.0 - Permissive Cross-domain Security Policy with Untrusted Domains
CVSS 5.4
CVE-2025-25264 MEDIUM
WAGO CC100, PFC100, PFC200, TP600 - Unauthenticated Arbitrary File Read via CORS Misconfiguration
CVSS 6.5
CVE-2025-41366 MEDIUM
ZIV IDF and ZLF - High-Privilege CORS Misconfiguration
CVE-2025-41363 MEDIUM
ZIV IDF and ZLF - View-Permission CORS Misconfiguration
CVE-2025-4839 LOW
itwanger paicoding 1.0.0-1.0.3 - Permissive Cross-domain Security Policy in CrossUtil.java
CVSS 3.1
CVE-2025-4542 LOW
Freeebird Hotel < 1.2 - Permissive Cross-domain Security Policy with Untrusted Domains
CVSS 3.1
CVE-2025-4515 MEDIUM
pribai/privategpt < 0.6.2 - Permissive Cross-domain Security Policy via allow_origins Argument
CVSS 4.3
Details
Vulnerabilities 115
Links
MITRE CWE Entry Search this CWE With Exploits