CWE-796
Only Filtering Special Elements Relative to a Marker
The product receives data from an upstream component, but only accounts for special elements positioned relative to a marker (e.g. at the beginning/end of a string; the second argument), thereby missing remaining special elements that may exist before sending it to a downstream component.
Impactr finds and proves whether CWE-796 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.