CWE-374
Passing Mutable Objects to an Untrusted Method
The product sends non-cloned mutable data as an argument to a method or function.
Impactr finds and proves whether CWE-374 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.