# CWE-15. Every Advisory and CVE whose sources give the weakness CWE-15, newest first. ## Records, newest first (an older page) - [Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation)](https://agentprime.io/advisories/CVE-2026-0495.md) `CVE-2026-0495` · CVE record: SAP_SE SAP Fiori App (Intercompany Balance Reconciliation) · CVSS 5.1 Medium · Not analysed yet · Published 13 Jan 2026 · Tags: CWE-15 - [External Control of System or Configuration Setting and Uncontrolled Search Path Element in sfw](https://agentprime.io/advisories/CVE-2025-64726.md) `CVE-2025-64726` · CVE record: SocketDev firewall-release · CVSS 7.3 High · Not analysed yet · Published 13 Nov 2025 · Tags: CWE-15, CWE-427 - [Taguette password reset link poisoning](https://agentprime.io/advisories/GHSA-7rc8-5c8q-jr6j.md) `GHSA-7rc8-5c8q-jr6j`, `CVE-2025-62527`, `PYSEC-2025-187` · PyPI `taguette`: affected `<1.5.0`, fixed in `1.5.0` · CVSS 7.1 High · Not analysed yet · Published 20 Oct 2025 · Tags: CWE-15 - [Liferay Portal has External Control of System or Configuration Settings](https://agentprime.io/advisories/GHSA-vp64-77c6-33h8.md) `GHSA-vp64-77c6-33h8`, `CVE-2025-43792` · Maven `com.liferay.portal:com.liferay.portal.kernel`: affected `<130.0.1`, fixed in `130.0.1` · CVSS 2.3 Low · Not analysed yet · Published 15 Sept 2025 · Tags: CWE-15 - [Post auth nginx configuration injection in Danfoss AK-SM8xxA Series](https://agentprime.io/advisories/CVE-2025-41452.md) `CVE-2025-41452` · CVE record: Danfoss AK-SM8xxA Series · CVSS 6.8 Medium · Not analysed yet · Published 22 Aug 2025 · Tags: CWE-15 - [Netavark Has Possible DNS Resolve Confusion](https://agentprime.io/advisories/GHSA-rpcf-rmh6-42xr.md) `GHSA-rpcf-rmh6-42xr`, `CVE-2025-8283` · crates.io `netavark`: affected `<1.15.1`, fixed in `1.15.1` · CVSS 3.7 Low · Not analysed yet · Published 28 Jul 2025 · Tags: CWE-15 - [wftpserver Wing FTP Server: Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of…](https://agentprime.io/advisories/CVE-2025-27889.md) `CVE-2025-27889` · CVE record: wftpserver Wing FTP Server · CVSS 3.4 Low · Not analysed yet · Published 10 Jul 2025 · Tags: CWE-15 - [Growatt Cloud portal External Control of System or Configuration Setting](https://agentprime.io/advisories/CVE-2025-30512.md) `CVE-2025-30512` · CVE record: Growatt Cloud portal · CVSS 6.9 Medium · Not analysed yet · Published 15 Apr 2025 · Tags: CWE-15 - [ingress-nginx controller - configuration injection via unsanitized mirror annotations](https://agentprime.io/advisories/GHSA-vg63-w3p9-jc9m.md) `GHSA-vg63-w3p9-jc9m`, `CVE-2025-1098`, `GO-2025-3568` · Go `k8s.io/ingress-nginx`: affected `<1.11.5 || >=1.12.0-beta.0, <1.12.1`, fixed in `1.11.5`, `1.12.1` · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.86 · Not analysed yet · Published 25 Mar 2025 · Tags: CWE-15, CWE-20 - [ingress-nginx controller - configuration injection via unsanitized auth-url annotation](https://agentprime.io/advisories/GHSA-fwwp-xcxw-39vq.md) `GHSA-fwwp-xcxw-39vq`, `CVE-2025-24514`, `GO-2025-3566` · Go `k8s.io/ingress-nginx`: affected `<1.11.5 || >=1.12.0-beta.0, <1.12.1`, fixed in `1.11.5`, `1.12.1` · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.37 · Not analysed yet · Published 25 Mar 2025 · Tags: CWE-15, CWE-20 - [ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation](https://agentprime.io/advisories/GHSA-823x-fv5p-h7hw.md) `GHSA-823x-fv5p-h7hw`, `CVE-2025-1097`, `GO-2025-3565` · Go `k8s.io/ingress-nginx`: affected `<1.11.5 || >=1.12.0-beta.0, <1.12.1`, fixed in `1.11.5`, `1.12.1` · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.37 · Not analysed yet · Published 25 Mar 2025 · Tags: CWE-15, CWE-20 - [A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that establishes a TCP connection th…](https://agentprime.io/advisories/CVE-2025-27253.md) `CVE-2025-27253` · CVE record: GE Vernova N60 multilin and 4 more · CVSS 6.1 Medium · Not analysed yet · Published 10 Mar 2025 · Tags: CWE-15 - [Local Privilege Escalation via Config Manipulation](https://agentprime.io/advisories/CVE-2025-0425.md) `CVE-2025-0425` · CVE record: Cordaware bestinformed Infoclient · CVSS 8.5 High · Not analysed yet · Published 18 Feb 2025 · Tags: CWE-15 - [Traffic Alert and Collision Avoidance System (TCAS) II has an External Control of System or Configuration Setting vulnerability](https://agentprime.io/advisories/CVE-2024-11166.md) `CVE-2024-11166` · CVE record: Traffic Alert and Collision Avoidance System (TCAS) II Collision Avoidance Systems · CVSS 7.1 High · Not analysed yet · Published 22 Jan 2025 · Tags: CWE-15 - [Wavlink AC3000: Multiple external config control vulnerabilities exists in the openvpn.cgi…](https://agentprime.io/advisories/CVE-2024-39800.md) `CVE-2024-39800` · CVE record: Wavlink Wavlink AC3000 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-15 - [Wavlink AC3000: Multiple external config control vulnerabilities exists in the openvpn.cgi…](https://agentprime.io/advisories/CVE-2024-39799.md) `CVE-2024-39799` · CVE record: Wavlink Wavlink AC3000 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-15 - [Wavlink AC3000: Multiple external config control vulnerabilities exists in the openvpn.cgi…](https://agentprime.io/advisories/CVE-2024-39798.md) `CVE-2024-39798` · CVE record: Wavlink Wavlink AC3000 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-15 - [Wavlink AC3000: An external config control vulnerability exists in the openvpn.cgi openvpn_client_setup()…](https://agentprime.io/advisories/CVE-2024-38666.md) `CVE-2024-38666` · CVE record: Wavlink Wavlink AC3000 · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.19 · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-15 - [Wavlink AC3000: An external config control vulnerability exists in the nas.cgi set_nas() functionality of…](https://agentprime.io/advisories/CVE-2024-39602.md) `CVE-2024-39602` · CVE record: Wavlink Wavlink AC3000 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-15 - [Wavlink AC3000: Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd…](https://agentprime.io/advisories/CVE-2024-39795.md) `CVE-2024-39795` · CVE record: Wavlink Wavlink AC3000 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-15 - [Wavlink AC3000: Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd…](https://agentprime.io/advisories/CVE-2024-39794.md) `CVE-2024-39794` · CVE record: Wavlink Wavlink AC3000 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-15 - [Wavlink AC3000: Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd…](https://agentprime.io/advisories/CVE-2024-39793.md) `CVE-2024-39793` · CVE record: Wavlink Wavlink AC3000 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-15 - [Wavlink AC3000: An external config control vulnerability exists in the nas.cgi set_smb_cfg()…](https://agentprime.io/advisories/CVE-2024-39280.md) `CVE-2024-39280` · CVE record: Wavlink Wavlink AC3000 · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.35 · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-15 - [Wavlink AC3000: Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg()…](https://agentprime.io/advisories/CVE-2024-39790.md) `CVE-2024-39790` · CVE record: Wavlink Wavlink AC3000 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-15 - [Wavlink AC3000: Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg()…](https://agentprime.io/advisories/CVE-2024-39789.md) `CVE-2024-39789` · CVE record: Wavlink Wavlink AC3000 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-15 - [Wavlink AC3000: Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg()…](https://agentprime.io/advisories/CVE-2024-39788.md) `CVE-2024-39788` · CVE record: Wavlink Wavlink AC3000 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-15 - [Security vulnerability in the HiView module Impact: Successful exploitation of this vulnerability may affect feature implementation and integrity.](https://agentprime.io/advisories/CVE-2024-54097.md) `CVE-2024-54097` · CVE record: Huawei HarmonyOS and 1 more · CVSS 7.3 High · Not analysed yet · Published 12 Dec 2024 · Tags: CWE-15 - [Service Control](https://agentprime.io/advisories/CVE-2024-51544.md) `CVE-2024-51544` · CVE record: ABB ASPECT-Enterprise and 2 more · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.13 · Not analysed yet · Published 5 Dec 2024 · Tags: CWE-15 - [Information Disclosure](https://agentprime.io/advisories/CVE-2024-51543.md) `CVE-2024-51543` · CVE record: ABB ASPECT-Enterprise and 2 more · CVSS 8.8 High · Not analysed yet · Published 5 Dec 2024 · Tags: CWE-15 - [Advantech EKI-6333AC-2G: A CWE-15 "External Control of System or Configuration Setting" was discovered affecting…](https://agentprime.io/advisories/CVE-2024-50358.md) `CVE-2024-50358` · CVE record: Advantech EKI-6333AC-2G and 2 more · CVSS 7.2 High · Not analysed yet · Published 26 Nov 2024 · Tags: CWE-15 - [Flowise OverrideConfig security vulnerability](https://agentprime.io/advisories/GHSA-5cph-wvm9-45gj.md) `GHSA-5cph-wvm9-45gj`, `CVE-2024-58351` · npm `flowise`: affected `<2.1.4`, fixed in `2.1.4` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Nov 2024 · Tags: Code injection, CWE-15 - [PostgreSQL PL/Perl environment variable changes execute arbitrary code](https://agentprime.io/advisories/CVE-2024-10979.md) `CVE-2024-10979` · CVE record: PostgreSQL · CVSS 8.8 High · Not analysed yet · Published 14 Nov 2024 · Tags: CWE-15 - [github.com/gitpod-io/gitpod vulnerable to Cookie Tossing](https://agentprime.io/advisories/GHSA-8pgc-65mj-53h5.md) `GHSA-8pgc-65mj-53h5`, `CVE-2024-21583`, `GO-2024-2997` · Go `github.com/gitpod-io/gitpod`: affected `<=0.8.0`, no fixed version yet · CVSS 4.1 Medium · Not analysed yet · Published 19 Jul 2024 · Tags: CWE-15, CWE-565 - [Remote Code Execution via \`/apply_settings\` and \`/execute_code\` in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-4326.md) `CVE-2024-4326` · CVE record: parisneo parisneo/lollms-webui · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 May 2024 · Tags: CWE-15 - [Local privilege escalation in Bitdefender Total Security (VA-11168)](https://agentprime.io/advisories/CVE-2023-6154.md) `CVE-2023-6154` · CVE record: Bitdefender Total Security and 3 more · CVSS 7.8 High · Not analysed yet · Published 1 Apr 2024 · Tags: CWE-15 - [Micronaut management endpoints vulnerable to drive-by localhost attack](https://agentprime.io/advisories/GHSA-583g-g682-crxf.md) `GHSA-583g-g682-crxf`, `CVE-2024-23639` · Maven `io.micronaut:micronaut-http-server` and 2 more: affected `<3.8.3`, fixed in `3.8.3` · CVSS 5.1 Medium · Not analysed yet · Published 9 Feb 2024 · Tags: CWE-15, CWE-610, CWE-664 - [php-svg-lib unsafe attributes merge when parsing \`use\` tag](https://agentprime.io/advisories/CVE-2023-50252.md) `CVE-2023-50252` · CVE record: dompdf php-svg-lib · CVSS 8.3 High · Critical (CVSS 7+ and EPSS) · EPSS 0.24 · Not analysed yet · Published 12 Dec 2023 · Tags: Insecure deserialization, CWE-15 - [Unauthorized startup vulnerability of background apps.](https://agentprime.io/advisories/CVE-2023-46764.md) `CVE-2023-46764` · CVE record: Huawei HarmonyOS and 1 more · No CVSS score · Not analysed yet · Published 8 Nov 2023 · Tags: CWE-15 - [Overwrite of builtin Cody commands facilitates RCE](https://agentprime.io/advisories/CVE-2023-46248.md) `CVE-2023-46248` · CVE record: sourcegraph cody · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Oct 2023 · Tags: CWE-15 - [mooSocial 3.1.8 is vulnerable to external service interaction on post function.](https://agentprime.io/advisories/CVE-2023-43323.md) `CVE-2023-43323` · CVE record · No CVSS score · Not analysed yet · Published 28 Sept 2023 · Tags: CWE-15 - [External Control of System or Configuration Setting in instantsoft/icms2](https://agentprime.io/advisories/CVE-2023-4704.md) `CVE-2023-4704` · CVE record: instantsoft instantsoft/icms2 · CVSS 8.8 High · Not analysed yet · Published 1 Sept 2023 · Tags: CWE-15 - [Code Execution through Writable Mosquitto Configuration File](https://agentprime.io/advisories/CVE-2023-3321.md) `CVE-2023-3321` · CVE record: ABB ABB Ability™ zenon · CVSS 7.0 High · Not analysed yet · Published 24 Jul 2023 · Tags: CWE-15 - [Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter parameters.](https://agentprime.io/advisories/CVE-2023-32349.md) `CVE-2023-32349` · CVE record: Teltonika RUT model routers · CVSS 8.0 High · Not analysed yet · Published 22 May 2023 · Tags: CWE-15 - [in-toto vulnerable to Configuration Read From Local Directory](https://agentprime.io/advisories/GHSA-wc64-c5rv-32pf.md) `GHSA-wc64-c5rv-32pf`, `CVE-2023-32076`, `GHSA-p86f-xmg6-9q4x`, `PYSEC-2023-63` · PyPI `in-toto`: affected `<2.0.0`, fixed in `2.0.0` · CVSS 5.5 Medium · Not analysed yet · Published 11 May 2023 · Tags: CWE-15, CWE-610 - [The security module has configuration defects.Successful exploitation of this vulnerability may affect system availability.](https://agentprime.io/advisories/CVE-2022-41582.md) `CVE-2022-41582` · CVE record: Huawei HarmonyOS and 1 more · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2022 · Tags: CWE-15 - [PerFact OpenVPN-Client](https://agentprime.io/advisories/CVE-2021-27406.md) `CVE-2021-27406` · CVE record: PerFact OpenVPN-Client · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2022 · Tags: CWE-15 - [AUVESY Versiondog](https://agentprime.io/advisories/CVE-2021-38453.md) `CVE-2021-38453` · CVE record: AUVESY Versiondog · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2021 · Tags: CWE-15 - [A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.0 SP1).](https://agentprime.io/advisories/CVE-2021-31338.md) `CVE-2021-31338` · CVE record: Siemens SINEMA Remote Connect Client · No CVSS score · Not analysed yet · Published 19 Aug 2021 · Tags: CWE-15 - [D-Link DSL-2750U: D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to…](https://agentprime.io/advisories/CVE-2021-3707.md) `CVE-2021-3707` · CVE record: D-Link DSL-2750U · No CVSS score · Not analysed yet · Published 16 Aug 2021 · Tags: CWE-15 Newest: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .