CWE-349
Acceptance of Extraneous Untrusted Data With Trusted Data
The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
Impactr finds and proves whether CWE-349 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.