Skip to content
OpenAdvisories

Weakness (CWE)

CWE-683: Function Call With Incorrect Order of Arguments

Variant Draft

The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order.

How to prevent it (1 mitigation)

  1. Implementation

    Use the function, procedure, or routine as specified.

Source: MITRE CWE-683

All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • Medium 6.3
    CVE-2026-32269

    Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.13 and 8.6.39, the OAuth2 authentication adapter does not correctly validate app IDs when appidField and appIds are configured. During…

    parse-community parse-server parse-server npm
  • Medium 5.5
    CVE-2026-24846

    malcontent's archive extraction could write outside extraction directory

    malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 1.8.0 and prior to version 1.20.3, malcontent could be made to create symlinks outside the intended extraction directory when scanning a speci…

    chainguard-dev malcontent github.com/chainguard-dev/malcontent Go
  • Low 1.8
    CVE-2025-47278

    Flask uses fallback key instead of current signing key

    Flask is a web server gateway interface (WSGI) web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the …

    pallets flask flask flask Debian PyPI
  • Medium 4.3
    CVE-2023-5352

    Awesome Support < 6.1.5 - Insufficient permission check in wpas_edit_reply

    The Awesome Support WordPress plugin before 6.1.5 does not correctly authorize the wpas_edit_reply function, allowing users to edit posts for which they do not have permission.

    Web / CMS
  • High 7.5
    CVE-2023-32059

    Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls

    Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments are compiled incorrectly. Depending on the number of arguments provided in the call, the defaults are added not right-t…

    vyperlang vyper vyper PyPI