CWE-830
Inclusion of Web Functionality from an Untrusted Source
The product includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source.
Impactr finds and proves whether CWE-830 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.