Skip to content
OpenAdvisories

Weakness (CWE)

CWE-235: Improper Handling of Extra Parameters

Variant Draft

The product does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.

Source: MITRE CWE-235

All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • Medium —
    GHSA-92hr-gmr6-h8cp

    Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling

    Fix: PR #7906 (ether/etherpad). A set of medium/low hardening fixes: - **Weak RNG for tokens (CWE-330):** author/session/readonly IDs were generated with `Math.random()` (client and server). Now use `crypto.getRandomValues`. - **Login timing / no failure dela…

    ep_etherpad-lite npm
  • High 7.4
    CVE-2026-27851

    When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interprete…

    Open-Xchange OX Dovecot Pro dovecot dovecot Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2026-20083

    A vulnerability in the Secure Copy Protocol (SCP) server feature of Cisco IOS XE Software could allow an authenticated,…

    Cisco Cisco IOS XE Software iOS Network devices
  • High 7.1
    CVE-2024-47651

    Parameter Pollution Vulnerability

    This vulnerability exists in Shilpi Client Dashboard due to improper handling of multiple parameters in the API endpoint. An authenticated remote attacker could exploit this vulnerability by including multiple “userid” parameters in the API request body leadi…

    Shilpi Computers Client Dashboard
  • Medium 6.3
    CVE-2017-20160

    flitto express-param fetchParams.js parameter pollution

    A vulnerability was found in flitto express-param up to 0.x. It has been classified as critical. This affects an unknown part of the file lib/fetchParams.js. The manipulation leads to improper handling of extra parameters. It is possible to initiate the attac…

    flitto express-param express-param npm