Skip to content
OpenAdvisories

Weakness (CWE)

CWE-697: Incorrect Comparison

Pillar Incomplete Mapping discouraged

The product compares two entities in a security-relevant context, but the comparison is incorrect.

Source: MITRE CWE-697

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.4
    CVE-2026-73309 Public exploit

    XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint

    XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for client_secret and code_verifier parameters. Attackers can explo…

    XenForo XenForo
  • High 8.6
    CVE-2025-20343 Public exploit

    Cisco Identity Services Engine Radius Suppression Denial of Service Vulnerability

    A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly. This vulnerability is due to a…

    Cisco Cisco Identity Services Engine Software Network devices
  • High 8.1
    CVE-2025-3102 Public exploit EPSS 76%

    SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation

    The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all v…

    brainstormforce OttoKit: All-in-One Automation Platform Web / CMS
  • Medium 6.6
    CVE-2024-41958 Public exploit

    Two-Factor Authentication (2FA) Bypass in mailcow: dockerized

    mailcow: dockerized is an open source groupware/email suite based on docker. A vulnerability has been discovered in the two-factor authentication (2FA) mechanism. This flaw allows an authenticated attacker to bypass the 2FA protection, enabling unauthorized a…

    mailcow mailcow-dockerized
  • Medium 6.5
    CVE-2023-40037 Public exploit

    Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs

    Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass…

    Apache Software Foundation Apache NiFi org.apache.nifi:nifi-jms-processors org.apache.nifi:nifi-dbcp-base Maven
  • Critical 9.8
    CVE-2023-32571 Public exploit EPSS 35%

    Dynamic Linq vulnerable to remote code execution

    Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.

    System.Linq.Dynamic.Core NuGet
  • High 7.5
    CVE-2020-5849 Exploited Public exploit EPSS 93%

    Unraid 6.8.0 allows authentication bypass.

    KEV Nov 3, 2021
  • High —
    CVE-2015-9238 Public exploit

    Insecure Comparison in secure-compare

    secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.

    HackerOne secure-compare node module secure-compare npm