CWE-547
Use of Hard-coded, Security-relevant Constants
The product uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change.
Impactr finds and proves whether CWE-547 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.