Skip to content
OpenAdvisories

Weakness (CWE)

CWE-183: Permissive List of Allowed Inputs

Base Draft

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.

Source: MITRE CWE-183

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.7
    CVE-2026-46391 Public exploit

    HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be…

    haxtheweb @haxtheweb/open-apis @haxtheweb/open-apis npm