Skip to content
OpenAdvisories

Weakness (CWE)

CWE-470: Use of Externally-Controlled Input to Select Classes or Code

Base Draft

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

More detail

An attacker could supply values to select unexpected classes or methods. If this occurs, then the attacker could create control flow paths that were not intended by the developer. These paths could bypass authentication or access control checks, or otherwise cause the product to behave in an unexpected manner. This situation becomes a doomsday scenario if the attacker can upload files into a location that appears on the product's classpath (CWE-427) or add new entries to the product's classpath (CWE-426). Under either of these conditions, the attacker can use reflection to introduce new, malicious behavior into the product.

How to prevent it (3 mitigations)

  1. Architecture and Design

    Refactor your code to avoid using reflection.

  2. Architecture and Design

    Do not use user-controlled inputs to select and load classes or code.

  3. Implementation

    Apply strict input validation by using allowlists or indirect selection to ensure that the user is only selecting allowable classes or code.

Source: MITRE CWE-470

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-58400 Exploited

    GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter

    GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and without disabling J…

    geonetwork core-geonetwork
  • Critical 9.4
    CVE-2026-82078 Exploited Public exploit EPSS 63%

    PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector

    An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approv…

    PaperCut PaperCut MF/NG
    KEV Aug 31, 2026
  • Critical 9.8
    CVE-2021-21985 Exploited · Ransomware Public exploit EPSS 100%

    The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtua…

    Virtualization
    KEV Nov 3, 2021