Weaknesses of type CWE-15

94 results

Controle Externo de Configurações do Sistema

A aplicação permite que um atacante modifique configurações críticas do sistema ou da aplicação através de entrada externa (parâmetros, arquivos, variáveis de ambiente, etc.), sem validação adequada. Isso pode levar ao comprometimento da segurança, funcionamento incorreto ou acesso não autorizado.

Example

Um serviço web aceita um parâmetro 'debug_mode' vindo da requisição HTTP e o usa diretamente para ligar/desligar logs sensíveis ou alternar validações de segurança. Um atacante manda debug_mode=true e expõe dados internos ou desativa proteções.

How to mitigate

Nunca confie em entradas externas para configurações sensíveis. Use apenas fontes confiáveis (arquivo de config protegido no servidor, variáveis de ambiente do deployment) e valide/sanitize rigorosamente qualquer entrada que possa impactar comportamento de segurança.

CVE-2026-16708HIGHIBM Db2 Mirror for i is affected by multiple vulnerabilitiesEPSS 0.4%CVE-2026-54918MEDIUMNetBox Device Type Library: PR-controllable upstream clone URL (NETBOX_DT_LIBRARY_URL) enables SSRF and test-data substitution from CIEPSS 0.4%CVE-2019-25716HIGHDräger Infinity Delta/Kappa Patient Monitor DoS via Malformed Network PacketEPSS 0.4%CVE-2026-107818HIGHMariaDB: environment injection via wsrep bootstrap in the mariadb.service fileEPSS 0.4%CVE-2026-27203HIGHeBay API MCP Server Affected by Environment Variable InjectionEPSS 0.4%CVE-2026-22177MEDIUMOpenClaw < 2026.2.21 - Environment Variable Injection via Config env.varsEPSS 0.4%CVE-2023-46764—Unauthorized startup vulnerability of background apps. Successful exploitation of this vulnerability may cause background apps to start maliEPSS 0.4%CVE-2026-46485HIGHDash: Users can write to config despire permissions (OIDC tested)EPSS 0.4%CVE-2026-96188HIGHMicrosoft PowerToys Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2023-3321HIGHCode Execution through Writable Mosquitto Configuration FileEPSS 0.4%CVE-2025-8283LOWNetavark: podman: netavark may resolve hostnames to unexpected hostsEPSS 0.4%CVE-2026-30817MEDIUMArbitrary File Reading Vulnerability in dnsmasq Module in TP-Link AX53EPSS 0.4%CVE-2025-13091MEDIUMShopire <= 1.0.57 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin InstallEPSS 0.4%CVE-2026-110845HIGHn8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log OperationEPSS 0.3%CVE-2024-51543HIGHInformation DisclosureEPSS 0.3%CVE-2024-54097HIGHSecurity vulnerability in the HiView module Impact: Successful exploitation of this vulnerability may affect feature implementation and inteEPSS 0.3%CVE-2026-13292HIGHIBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerabilityEPSS 0.3%CVE-2026-121427HIGHAzuraCast through 0.23.8 Config Injection via frontend_config.custom_configEPSS 0.3%CVE-2025-43792LOWRemote staging in Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.EPSS 0.3%CVE-2026-73661HIGHFreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted BackupEPSS 0.3%