CWE-507
Trojan Horse
The product appears to contain benign or useful functionality, but it also contains code that is hidden from normal operation that violates the intended security policy of the user or the system administrator.
Impactr finds and proves whether CWE-507 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.