CWE-493
Critical Public Variable Without Final Modifier
The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.
Impactr finds and proves whether CWE-493 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.