CWE-148
Improper Neutralization of Input Leaders
The product does not properly handle when a leading character or sequence (leader) is missing or malformed, or if multiple leaders are used when only one should be allowed.
Impactr finds and proves whether CWE-148 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.