CWE-472
External Control of Assumed-Immutable Web Parameter
The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
Impactr finds and proves whether CWE-472 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.