Weaknesses of type CWE-15

94 results

Controle Externo de Configurações do Sistema

A aplicação permite que um atacante modifique configurações críticas do sistema ou da aplicação através de entrada externa (parâmetros, arquivos, variáveis de ambiente, etc.), sem validação adequada. Isso pode levar ao comprometimento da segurança, funcionamento incorreto ou acesso não autorizado.

Example

Um serviço web aceita um parâmetro 'debug_mode' vindo da requisição HTTP e o usa diretamente para ligar/desligar logs sensíveis ou alternar validações de segurança. Um atacante manda debug_mode=true e expõe dados internos ou desativa proteções.

How to mitigate

Nunca confie em entradas externas para configurações sensíveis. Use apenas fontes confiáveis (arquivo de config protegido no servidor, variáveis de ambiente do deployment) e valide/sanitize rigorosamente qualquer entrada que possa impactar comportamento de segurança.

CVE-2026-30816MEDIUMArbitrary File Reading Vulnerability in OpenVPN Module in TP-Link AX53EPSS 0.3%CVE-2026-46399CRITICALAuthenticated Remote Code Execution via File OverwriteEPSS 0.3%CVE-2026-103442HIGHMergeAccount PHP object injection via session-key substitutionEPSS 0.3%CVE-2024-11166HIGHTraffic Alert and Collision Avoidance System (TCAS) II has an External Control of System or Configuration Setting vulnerabilityEPSS 0.3%CVE-2024-23639MEDIUMmicronaut-core management endpoints vulnerable to drive-by localhost attackEPSS 0.3%CVE-2026-44768MEDIUMSecurity misconfiguration in SAP CRM (WebClient UI)EPSS 0.3%CVE-2025-62527HIGHTaguette vulnerable to password reset link poisoningEPSS 0.3%CVE-2026-107503HIGHIn Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer UI loads its complete environment configuration, including EPSS 0.2%CVE-2026-0418MEDIUMCertain NETGEAR devices allow administrators to tamper with systemEPSS 0.2%CVE-2023-32076MEDIUMin-toto vulnerable to Configuration Read From Local DirectoryEPSS 0.2%CVE-2021-31338—A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.0 SP1). Affected devices allow to modify configuratioEPSS 0.2%CVE-2026-66065HIGHOuroboros: Untrusted project .env can still reach RCE via omitted execution-routing keys (Incomplete fix of CVE-2026-47211)EPSS 0.2%CVE-2025-27253MEDIUMA CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attEPSS 0.2%CVE-2026-19884HIGHIn Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trustEPSS 0.2%CVE-2026-22750HIGHSSL bundle configuration silently bypassed in Spring Cloud GatewayEPSS 0.2%CVE-2026-43531HIGHOpenClaw < 2026.4.9 - Environment Variable Injection via Workspace .env FileEPSS 0.2%CVE-2023-6154HIGHLocal privilege escalation in Bitdefender Total Security (VA-11168)EPSS 0.2%CVE-2026-1784HIGHOse-cluster-ingress-operator: remote code execution through haproxy configuration injectionEPSS 0.2%CVE-2026-105294CRITICALLegcord 1.1.0 through 1.3.0 Chromium Switch Injection via settings.setConfigEPSS 0.2%CVE-2026-85217HIGHMan-in-the-Middle (MITM) Vulnerability in Autodesk Fusion DesktopEPSS 0.2%