CWE-610
Externally Controlled Reference to a Resource in Another Sphere
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
Impactr finds and proves whether CWE-610 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.