Skip to content
OpenAdvisories

Weakness (CWE)

CWE-794: Incomplete Filtering of Multiple Instances of Special Elements

Variant Incomplete

The product receives data from an upstream component, but it does not filter all instances of a special element before sending it to a downstream component.

More detail

Incomplete filtering of this nature may be applied to:

- sequential elements (special elements that appear next to each other) or

- non-sequential elements (special elements that appear multiple times in different locations).

Source: MITRE CWE-794

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.3
    CVE-2026-21876 Public exploit EPSS 17%

    OWASP CRS has multipart bypass using multiple content-type parts

    The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the …

    coreruleset coreruleset modsecurity-crs modsecurity-crs Debian Ubuntu