CWE-512
Spyware
The product collects personally identifiable information about a human user or the user's activities, but the product accesses this information using other resources besides itself, and it does not require that user's explicit approval or direct input into the product.
Impactr finds and proves whether CWE-512 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.