CWE-794
Incomplete Filtering of Multiple Instances of Special Elements
The product receives data from an upstream component, but does not filter all instances of a special element before sending it to a downstream component.
Impactr finds and proves whether CWE-794 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.