Advisories · Weakness
CWE-15.
Every Advisory and CVE whose sources give the weakness CWE-15, newest first.
- CVSS 5.1 Medium
Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation)
- SAP_SE SAP Fiori App (Intercompany Balance Reconciliation)
- CWE-15
- CVSS 7.3 High
External Control of System or Configuration Setting and Uncontrolled Search Path Element in sfw
- SocketDev firewall-release
- CWE-15
- CWE-427
- CVSS 7.1 High
Taguette password reset link poisoning
- CWE-15
<1.5.0 · fixed in 1.5.0
GHSA-7rc8-5c8q-jr6j · CVE-2025-62527 - CVSS 2.3 Low
Liferay Portal has External Control of System or Configuration Settings
- CWE-15
<130.0.1 · fixed in 130.0.1
GHSA-vp64-77c6-33h8 · CVE-2025-43792 - CVSS 6.8 Medium
Post auth nginx configuration injection in Danfoss AK-SM8xxA Series
- Danfoss AK-SM8xxA Series
- CWE-15
- CVSS 3.7 Low
Netavark Has Possible DNS Resolve Confusion
- CWE-15
<1.15.1 · fixed in 1.15.1
GHSA-rpcf-rmh6-42xr · CVE-2025-8283 - CVSS 3.4 Low
wftpserver Wing FTP Server: Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of…
- wftpserver Wing FTP Server
- CWE-15
- CVSS 6.9 Medium
Growatt Cloud portal External Control of System or Configuration Setting
- Growatt Cloud portal
- CWE-15
- CVSS 8.8 HighCritical · CVSS 7+ and EPSS
ingress-nginx controller - configuration injection via unsanitized mirror annotations
- CWE-15
- CWE-20
<1.11.5 || >=1.12.0-beta.0, <1.12.1 · fixed in 1.11.5, 1.12.1
GHSA-vg63-w3p9-jc9m · CVE-2025-1098 - CVSS 8.8 HighCritical · CVSS 7+ and EPSS
ingress-nginx controller - configuration injection via unsanitized auth-url annotation
- CWE-15
- CWE-20
<1.11.5 || >=1.12.0-beta.0, <1.12.1 · fixed in 1.11.5, 1.12.1
GHSA-fwwp-xcxw-39vq · CVE-2025-24514 - CVSS 8.8 HighCritical · CVSS 7+ and EPSS
ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation
- CWE-15
- CWE-20
<1.11.5 || >=1.12.0-beta.0, <1.12.1 · fixed in 1.11.5, 1.12.1
GHSA-823x-fv5p-h7hw · CVE-2025-1097 - CVSS 6.1 Medium
A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that establishes a TCP connection th…
- GE Vernova N60 multilin
- GE Vernova B30 Multilin
- CWE-15
- CVSS 8.5 High
Local Privilege Escalation via Config Manipulation
- Cordaware bestinformed Infoclient
- CWE-15
- CVSS 7.1 High
Traffic Alert and Collision Avoidance System (TCAS) II has an External Control of System or Configuration Setting vulnerability
- Traffic Alert and Collision Avoidance System (TCAS) II Collision Avoidance Systems
- CWE-15
- CVSS 9.1 CriticalCritical · CVSS 9+
Wavlink AC3000: Multiple external config control vulnerabilities exists in the openvpn.cgi…
- Wavlink AC3000
- CWE-15
- CVSS 9.1 CriticalCritical · CVSS 9+
Wavlink AC3000: Multiple external config control vulnerabilities exists in the openvpn.cgi…
- Wavlink AC3000
- CWE-15
- CVSS 9.1 CriticalCritical · CVSS 9+
Wavlink AC3000: Multiple external config control vulnerabilities exists in the openvpn.cgi…
- Wavlink AC3000
- CWE-15
- CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Wavlink AC3000: An external config control vulnerability exists in the openvpn.cgi openvpn_client_setup()…
- Wavlink AC3000
- CWE-15
- CVSS 9.1 CriticalCritical · CVSS 9+
Wavlink AC3000: An external config control vulnerability exists in the nas.cgi set_nas() functionality of…
- Wavlink AC3000
- CWE-15
- CVSS 9.1 CriticalCritical · CVSS 9+
Wavlink AC3000: Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd…
- Wavlink AC3000
- CWE-15
- CVSS 9.1 CriticalCritical · CVSS 9+
Wavlink AC3000: Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd…
- Wavlink AC3000
- CWE-15
- CVSS 9.1 CriticalCritical · CVSS 9+
Wavlink AC3000: Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd…
- Wavlink AC3000
- CWE-15
- CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Wavlink AC3000: An external config control vulnerability exists in the nas.cgi set_smb_cfg()…
- Wavlink AC3000
- CWE-15
- CVSS 9.1 CriticalCritical · CVSS 9+
Wavlink AC3000: Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg()…
- Wavlink AC3000
- CWE-15
- CVSS 9.1 CriticalCritical · CVSS 9+
Wavlink AC3000: Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg()…
- Wavlink AC3000
- CWE-15
- CVSS 9.1 CriticalCritical · CVSS 9+
Wavlink AC3000: Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg()…
- Wavlink AC3000
- CWE-15
- CVSS 7.3 High
Security vulnerability in the HiView module Impact: Successful exploitation of this vulnerability may affect feature implementation and integrity.
- Huawei HarmonyOS
- Huawei EMUI
- CWE-15
- CVSS 8.8 HighCritical · CVSS 7+ and EPSS
Service Control
- ABB ASPECT-Enterprise
- ABB NEXUS Series
- CWE-15
- CVSS 8.8 High
Information Disclosure
- ABB ASPECT-Enterprise
- ABB NEXUS Series
- CWE-15
- CVSS 7.2 High
Advantech EKI-6333AC-2G: A CWE-15 "External Control of System or Configuration Setting" was discovered affecting…
- Advantech EKI-6333AC-2G
- Advantech EKI-6333AC-2GD
- CWE-15
- CVSS 9.3 CriticalCritical · CVSS 9+
Flowise OverrideConfig security vulnerability
- Code injection
- CWE-15
<2.1.4 · fixed in 2.1.4
GHSA-5cph-wvm9-45gj · CVE-2024-58351 - CVSS 8.8 High
PostgreSQL PL/Perl environment variable changes execute arbitrary code
- PostgreSQL
- CWE-15
- CVSS 4.1 Medium
github.com/gitpod-io/gitpod vulnerable to Cookie Tossing
- CWE-15
- CWE-565
<=0.8.0 · no fixed version yet
GHSA-8pgc-65mj-53h5 · CVE-2024-21583 - CVSS 9.8 CriticalCritical · CVSS 9+
Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webui
- parisneo/lollms-webui
- CWE-15
- CVSS 7.8 High
Local privilege escalation in Bitdefender Total Security (VA-11168)
- Bitdefender Total Security
- Bitdefender Internet Security
- CWE-15
- CVSS 5.1 Medium
Micronaut management endpoints vulnerable to drive-by localhost attack
- CWE-15
- CWE-610
<3.8.3 · fixed in 3.8.3
GHSA-583g-g682-crxf · CVE-2024-23639 - CVSS 8.3 HighCritical · CVSS 7+ and EPSS
php-svg-lib unsafe attributes merge when parsing `use` tag
- dompdf php-svg-lib
- Insecure deserialization
- CWE-15
-
Unauthorized startup vulnerability of background apps.
- Huawei HarmonyOS
- Huawei EMUI
- CWE-15
- CVSS 9.1 CriticalCritical · CVSS 9+
Overwrite of builtin Cody commands facilitates RCE
- sourcegraph cody
- CWE-15
-
mooSocial 3.1.8 is vulnerable to external service interaction on post function.
- CWE-15
- CVSS 8.8 High
External Control of System or Configuration Setting in instantsoft/icms2
- instantsoft/icms2
- CWE-15
- CVSS 7.0 High
Code Execution through Writable Mosquitto Configuration File
- ABB Ability™ zenon
- CWE-15
- CVSS 8.0 High
Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter parameters.
- Teltonika RUT model routers
- CWE-15
- CVSS 5.5 Medium
in-toto vulnerable to Configuration Read From Local Directory
- CWE-15
- CWE-610
<2.0.0 · fixed in 2.0.0
GHSA-wc64-c5rv-32pf · CVE-2023-32076 - CVSS 7.5 High
The security module has configuration defects.Successful exploitation of this vulnerability may affect system availability.
- Huawei HarmonyOS
- Huawei EMUI
- CWE-15
- CVSS 8.8 High
PerFact OpenVPN-Client
- PerFact OpenVPN-Client
- CWE-15
- CVSS 9.1 CriticalCritical · CVSS 9+
AUVESY Versiondog
- AUVESY Versiondog
- CWE-15
-
A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.0 SP1).
- Siemens SINEMA Remote Connect Client
- CWE-15
-
D-Link DSL-2750U: D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to…
- D-Link DSL-2750U
- CWE-15