Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Auth state is persisted with `req.object.save(...)`, which writes back every client-supplied field of the login request body, not just the recomputed MFA authData. An attacker can mass-assign arbitrary user attributes (roles, ACLs, points, etc.) while exercising the MFA token flow, because the save runs with `useMasterKey: true`. Save the server-loaded objec
An object fetched from a shared/static component registry ($CLASS::get(...)) is reconfigured in place with caller-supplied property overrides via Craft::configure(). Because ::get() may return a request-cached/shared instance, the overrides mutate the live shared object rather than a per-request copy. If any overwritten property is later interpreted as code
Classes extending GlobalConfiguration must not use @DataBoundConstructor on their constructors. Global configurations are singletons managed by Jenkins, and exposing a @DataBoundConstructor enables Stapler data binding to instantiate or modify the configuration without proper authorization.
Classes extending GlobalConfiguration should not use @DataBoundConstructor or @DataBoundSetter annotations. Exposing global configuration to Stapler data binding allows attackers to modify global settings without administrative authorization.
Field reflection dynamically resolves and sets field values without checking if the field is static (`Modifier.isStatic`). In data binding or deserialization contexts, this allows untrusted input to modify static fields and alter global application state.
Passing unvalidated user input via `$request->all()` directly to Eloquent persistence or hydration methods (`update`, `fill`, `create`, `updateOrCreate`) can lead to mass assignment vulnerabilities. Use `$request->validated()`, `$request->safe()`, or `$request->only(...)` instead.
Usergroup modification without server-side sanitization allows privilege escalation.
Detected direct passing of parsed request body to entity edit logic without filtering sensitive backend configuration properties or checking appropriate permissions.
Permitting `:account_id` in Rails strong parameters allows user-controlled mass assignment of tenant association, which can lead to cross-account authorization bypass and resource takeover.
User API endpoint iterates over request data and performs mass assignment using a denylist that lacks permission checks for sensitive salary/compensation fields.
Detected dynamic property assignment from request data to an object without authorization checks for sensitive fields such as 'user_id'. An attacker could associate records with arbitrary user IDs and trigger unauthorized state or credential changes. Ensure authorization checks are performed before allowing sensitive properties to be modified.
Norman user store Update() persists the client-controlled request body ($DATA) straight through to the backing store without stripping any keys from it, so the immutable identity fields of a user resource (client.UserFieldUsername and client.UserFieldPrincipalIDs) are written verbatim: a caller holding only the update verb on users.management.cattle.io can r
Using a generic changeset (like `create_changeset`) for dynamic OpenID client registration can lead to mass assignment. An attacker might provide administrative fields (e.g., grant types, PKCE enforcement) that could be persisted if the changeset lacks a strict allowlist. Use a dedicated, restricted changeset for registering untrusted public clients.
Persisted credential field $FIELD carries a public JSON tag, so its secret value is serialized into every API response that marshals this model (and can also be set from request bodies decoded into the model). Because this value alone authenticates the account, any endpoint returning the model discloses a reusable bearer credential (CVE-2026-64859: admin use
Mass assignment (CWE-915): setattr($OBJ, $FIELD, ...) writes an attribute whose name is caller-controlled, but the only allowlist enforcement ("if $FIELD not in $ALLOWED: ...") is gated on the allowlist being set: it is nested inside "$ALLOWED is not None" (or a truthiness guard on $ALLOWED), conjoined with that guard in a single condition, or relegated to t
Unvalidated JSON patch applied directly to database storage via RestfulAPIJSONPatch. Direct patching without prior in-memory decoding, application, and profile validation allows unvalidated profile attribute injection and potential endpoint poisoning.
Sensitive SSO/OAuth/OIDC identity fields should not be extracted directly from user inputs via mass assignment, as this can lead to pre-account takeover.
Sanitizing an input array by unsetting restricted fields (like 'id') before applying an input normalization or transformation routine is vulnerable if the transformation step can reconstruct or hoist the restricted field back into the output array. Move the sanitization to occur strictly after the transformation, on the fully normalized data.
Merging path parameters with query or body parameters such that path parameters serve as the base map in `Map.merge/2`. In Elixir, `Map.merge/2` overwrites keys in the first map with keys from the second map. This allows untrusted user inputs from queries or request bodies to overwrite path-extracted variables, which can lead to Authorization Bypass or Insec
Sensitive identity attributes like 'userPassword' or 'inetuserstatus' are explicitly inserted into an attribute map that is subsequently applied to an identity via setAttributes(). This can lead to account takeover or reactivation of inactive accounts (CVE-2026-46623).
Unconditionally merging user-controlled data from HTTP requests (e.g., via `flask.request.get_json()`) into dictionaries using `update()` can lead to Mass Assignment vulnerabilities. If the dictionary is used for policy enforcement, authorization, or business logic state, attackers may overwrite trusted keys (e.g., `user_id` or `target`) resulting in privile
Directly returning the raw result property of an asynchronous operation without structural validation can lead to object property injection if the object originates from an untrusted source. Ensure that you explicitly pick only the expected fields into a new object literal.
Directly assigning a superglobal like $_POST or $_GET to $_SESSION, or iterating over a superglobal to populate another array without validating the keys, can lead to mass assignment and session pollution. Extract specific fields or use a form validation library instead.
Mass assignment vulnerability: a partially-filtered request payload obtained via $request->except([...]) (typically used to "drop the password before saving") is forwarded to an Eloquent model's fill() method without a positive field-name allowlist. Although the developer excluded one or two sensitive keys (e.g. out_password / in_password), an authenticated
