Weaknesses of type CWE-915

165 results

Modificação descontrolada de atributos de objetos determinados dinamicamente

A aplicação permite que um atacante modifique atributos de um objeto através de entrada do usuário sem validação adequada, porque o nome ou referência do atributo é construído dinamicamente a partir de dados não confiáveis. Isso pode levar a lógica de negócio comprometida, bypass de controles de acesso ou alteração de dados sensíveis.

Example

Um sistema web usa reflection ou mapeamento automático para atribuir parâmetros HTTP diretamente a propriedades de um objeto modelo (ex: `user.__proto__.isAdmin = true`). Um atacante envia `isAdmin=true` ou manipula o protótipo do objeto, escalando seus privilégios sem autenticação apropriada.

How to mitigate

Implemente um whitelist explícito de atributos que podem ser modificados dinamicamente, nunca permita entrada do usuário determinar diretamente qual propriedade será alterada. Desabilite reflection ou mapeamento automático em camadas sensíveis, e valide rigorosamente tipos e valores antes de qualquer atribuição.

CVE-2026-17598MEDIUMNexus Repository 3 - Improper Input Validation in Scheduled Task ConfigurationEPSS 0.3%CVE-2025-52656HIGHHCL MyXalytics product is affected by Mass Assignment vulnerabilityEPSS 0.3%CVE-2025-49597LOWhandcraftedinthealps goodby-csv Potential Gadget Chain allowing Remote Code ExecutionEPSS 0.2%CVE-2026-84430MEDIUMgouguoa edit_personal Endpoint Index.php update dynamically-determined object attributesEPSS 0.2%CVE-2026-5251MEDIUMz-9527 admin User Update Endpoint user.js dynamically-determined object attributesEPSS 0.2%CVE-2025-61781HIGHGraphQL IDOR allows authenticated user to delete workspace content of other usersEPSS 0.2%CVE-2026-5248MEDIUMgougucms User Registration Login.php reg_submit dynamically-determined object attributesEPSS 0.2%CVE-2026-45058CRITICALelecterm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmarkEPSS 0.2%CVE-2026-85408MEDIUMEleveo Quality Management Conversation events dynamically-determined object attributesEPSS 0.2%CVE-2026-23522LOWLobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File DeletionEPSS 0.2%CVE-2026-21886MEDIUMOpenCTI's GraphQL Mutations Allow Deletion of Unrelated EntitiesEPSS 0.2%CVE-2026-15083MEDIUMECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074EPSS 0.2%CVE-2026-72655MEDIUMImproperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data ModificationEPSS 0.2%CVE-2025-14341HIGHInput Data Manipulation in DivvyDrive Information Technologies' DivvyDriveEPSS 0.2%CVE-2026-31251HIGHCosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in EPSS 0.2%CVE-2026-31815MEDIUMdjango-unicorn affected by component state manipulation via unvalidated attribute accessEPSS 0.2%CVE-2026-28219LOWPrivilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global BannersEPSS 0.2%CVE-2026-42862HIGHFlowise: Mass Assignment in Tool Update Endpoint Allows Cross-Workspace Resource ReassignmentEPSS 0.2%CVE-2026-47850MEDIUMSpring Data REST allows mutation of the version property of immutable aggregates via PUTEPSS 0.2%CVE-2026-42540MEDIUMIRIS has a Mass Assignment issueEPSS 0.2%