CWE-914
Improper Control of Dynamically-Identified Variables
The product does not properly restrict reading from or writing to dynamically-identified variables.
Impactr finds and proves whether CWE-914 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.