Skip to content
OpenAdvisories

Weakness (CWE)

CWE-351: Insufficient Type Distinction

Base Draft

The product does not properly distinguish between different types of elements in a way that leads to insecure behavior.

Source: MITRE CWE-351

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-15305

    TYPO3 CMS - Unrestricted File Upload in Form Framework

    Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before…

    TYPO3 TYPO3 CMS typo3/cms-form Web / CMS Packagist
  • Medium 5.4
    CVE-2026-41341

    OpenClaw < 2026.3.31 - Component Interaction Misclassification in Discord Extension

    OpenClaw before 2026.3.31 contains a logic error in Discord component interaction routing that misclassifies group direct messages as direct messages in extensions/discord/src/monitor/agent-components-helpers.ts. Attackers can exploit this misclassification t…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.6
    CVE-2025-65960

    Contao is vulnerable to remote code execution in template closures

    Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issu…

    contao contao contao/core-bundle Packagist
  • Medium 5.4
    CVE-2025-47939

    TYPO3 CMS Vulnerable to Unrestricted File Upload in File Abstraction Layer

    TYPO3 is an open source, PHP based web content management system. By design, the file management module in TYPO3’s backend user interface has historically allowed the upload of any file type, with the exception of those that are directly executable in a web s…

    TYPO3 typo3 typo3/cms-core Web / CMS Packagist
  • Medium 4.3
    CVE-2024-45676

    IBM Cognos Controller file upload

    IBM Cognos Controller 11.0.0 and 11.0.1 could allow an authenticated user to upload insecure files, due to insufficient file type distinction.

    IBM Cognos Controller
  • Medium 5.9
    CVE-2024-4769

    When importing resources using Web Workers, error messages would distinguish the difference between `application/javasc…

    Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  • Medium 6.3
    CVE-2020-10134

    Bluetooth devices supporting LE and specific BR/EDR implementations are vulnerable to method confusion attacks

    Pairing in Bluetooth® Core v5.2 and earlier may permit an unauthenticated attacker to acquire credentials with two pairing devices via adjacent access when the unauthenticated user initiates different pairing methods in each peer device and an end-user errone…

    Bluetooth LE bluez Ubuntu