CWE-134
Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
Impactr finds and proves whether CWE-134 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.