CWE-642
External Control of Critical State Data
The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.
Impactr finds and proves whether CWE-642 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.