CWE-913
Allowed-with-ReviewImproper Control of Dynamically-Managed Code Resources
Abstraction: Class · Status: Incomplete
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
202 vulnerabilities reference this CWE, most recent first.
GHSA-4Q9H-CRQ4-9XJQ
Vulnerability from github – Published: 2026-04-01 03:31 – Updated: 2026-04-01 03:31A vulnerability has been found in gougucms 4.08.18. This affects the function reg_submit of the file gougucms-master\app\home\controller\Login.php of the component User Registration Handler. Such manipulation of the argument level leads to dynamically-determined object attributes. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-5248"
],
"database_specific": {
"cwe_ids": [
"CWE-913"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-01T01:16:41Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in gougucms 4.08.18. This affects the function reg_submit of the file gougucms-master\\app\\home\\controller\\Login.php of the component User Registration Handler. Such manipulation of the argument level leads to dynamically-determined object attributes. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-4q9h-crq4-9xjq",
"modified": "2026-04-01T03:31:40Z",
"published": "2026-04-01T03:31:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5248"
},
{
"type": "WEB",
"url": "https://thinhneee.github.io/posts/gougu-mass-assign"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/780589"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/354429"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/354429/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-562R-F8R6-C7WJ
Vulnerability from github – Published: 2025-12-09 18:30 – Updated: 2025-12-09 18:30Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files on the server, potentially leading to remote code execution. User interaction is required.
{
"affected": [],
"aliases": [
"CVE-2025-13659"
],
"database_specific": {
"cwe_ids": [
"CWE-913"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-09T16:17:35Z",
"severity": "HIGH"
},
"details": "Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files on the server, potentially leading to remote code execution. User interaction is required.",
"id": "GHSA-562r-f8r6-c7wj",
"modified": "2025-12-09T18:30:35Z",
"published": "2025-12-09T18:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13659"
},
{
"type": "WEB",
"url": "https://forums.ivanti.com/s/article/Security-Advisory-EPM-December-2025-for-EPM-2024"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5644-3VGQ-2PH5
Vulnerability from github – Published: 2025-06-19 21:31 – Updated: 2025-06-20 13:28Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.
By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE (Remote Code Execution).
This issue affects CrafterCMS: from 4.0.0 through 4.2.2.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.craftercms:crafter-studio"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-6384"
],
"database_specific": {
"cwe_ids": [
"CWE-913"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-20T13:28:38Z",
"nvd_published_at": "2025-06-19T21:15:27Z",
"severity": "HIGH"
},
"details": "Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.\n\nBy inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE (Remote Code Execution).\n\nThis issue affects CrafterCMS: from 4.0.0 through 4.2.2.",
"id": "GHSA-5644-3vgq-2ph5",
"modified": "2025-06-20T13:28:38Z",
"published": "2025-06-19T21:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6384"
},
{
"type": "WEB",
"url": "https://github.com/craftercms/studio/commit/471bbad07cf1f3b420529a020c1409ad57d48a4e"
},
{
"type": "WEB",
"url": "https://docs.craftercms.org/current/security/advisory.html#cv-2025061901"
},
{
"type": "PACKAGE",
"url": "https://github.com/craftercms/studio"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H",
"type": "CVSS_V4"
}
],
"summary": "Crafter Studio Groovy Sandbox Bypass"
}
GHSA-58PG-75F2-3JXJ
Vulnerability from github – Published: 2021-12-03 00:00 – Updated: 2021-12-04 00:01Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely (RCE).
{
"affected": [],
"aliases": [
"CVE-2021-23258"
],
"database_specific": {
"cwe_ids": [
"CWE-913"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-02T16:15:00Z",
"severity": "HIGH"
},
"details": "Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely (RCE).",
"id": "GHSA-58pg-75f2-3jxj",
"modified": "2021-12-04T00:01:15Z",
"published": "2021-12-03T00:00:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23258"
},
{
"type": "WEB",
"url": "https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120101"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-593M-55HH-J8GV
Vulnerability from github – Published: 2024-10-03 18:26 – Updated: 2024-10-04 16:32Impact
In case a Prototype Pollution vulnerability is present in a user's application or bundled libraries, the Sentry SDK could potentially serve as a gadget to exploit that vulnerability. The exploitability depends on the specific details of the underlying Prototype Pollution issue.
[!NOTE] This advisory does not indicate the presence of a Prototype Pollution within the Sentry SDK itself. Users are strongly advised to first address any Prototype Pollution vulnerabilities in their application, as they pose a more critical security risk.
Patches
The issue was patched in all Sentry JavaScript SDKs starting from the 8.33.0 version. Also, the fix was backported to SDK v7 in 7.119.1.
References
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@sentry/browser"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0-alpha.1"
},
{
"fixed": "8.33.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@sentry/browser"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.119.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-913"
],
"github_reviewed": true,
"github_reviewed_at": "2024-10-03T18:26:53Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Impact\nIn case a Prototype Pollution vulnerability is present in a user\u0027s application or bundled libraries, the Sentry SDK could potentially serve as a gadget to exploit that vulnerability. The exploitability depends on the specific details of the underlying Prototype Pollution issue.\n\n\u003e [!NOTE]\n\u003e This advisory does not indicate the presence of a Prototype Pollution within the Sentry SDK itself. Users are strongly advised to first address any Prototype Pollution vulnerabilities in their application, as they pose a more critical security risk.\n\n### Patches\nThe issue was patched in all Sentry JavaScript SDKs starting from the [8.33.0](https://github.com/getsentry/sentry-javascript/releases/tag/8.33.0) version.\nAlso, the fix was backported to SDK v7 in [7.119.1](https://github.com/getsentry/sentry-javascript/releases/tag/7.119.1).\n\n### References\n* [Prototype Pollution](https://portswigger.net/web-security/prototype-pollution)\n* [Prototype Pollution gadgets](https://portswigger.net/web-security/prototype-pollution#prototype-pollution-gadgets)\n* [sentry-javascript#13838](https://github.com/getsentry/sentry-javascript/pull/13838)",
"id": "GHSA-593m-55hh-j8gv",
"modified": "2024-10-04T16:32:02Z",
"published": "2024-10-03T18:26:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-593m-55hh-j8gv"
},
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry-javascript/pull/13838"
},
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry-javascript/commit/35bdc87dee3498794e34c1ad35dd9927950c8766"
},
{
"type": "PACKAGE",
"url": "https://github.com/getsentry/sentry-javascript"
},
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry-javascript/releases/tag/7.119.1"
},
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry-javascript/releases/tag/8.33.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Sentry SDK Prototype Pollution gadget in JavaScript SDKs"
}
GHSA-5FR5-6CWJ-9HP2
Vulnerability from github – Published: 2025-12-04 15:30 – Updated: 2025-12-04 15:30Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2024-5401"
],
"database_specific": {
"cwe_ids": [
"CWE-913"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-04T15:15:54Z",
"severity": "MODERATE"
},
"details": "Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors.",
"id": "GHSA-5fr5-6cwj-9hp2",
"modified": "2025-12-04T15:30:33Z",
"published": "2025-12-04T15:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5401"
},
{
"type": "WEB",
"url": "https://www.synology.com/en-global/security/advisory/Synology_SA_24_27"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5G3M-2273-P6X6
Vulnerability from github – Published: 2026-08-19 18:32 – Updated: 2026-08-27 06:31A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount arbitrary secrets into a search container's environment or replace the container image with an attacker-controlled one. This leads to privilege escalation and can result in a full cluster compromise due to the ServiceAccount's extensive impersonation permissions.
{
"affected": [],
"aliases": [
"CVE-2026-71470"
],
"database_specific": {
"cwe_ids": [
"CWE-913"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-19T17:20:57Z",
"severity": "CRITICAL"
},
"details": "A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount arbitrary secrets into a search container\u0027s environment or replace the container image with an attacker-controlled one. This leads to privilege escalation and can result in a full cluster compromise due to the ServiceAccount\u0027s extensive impersonation permissions.",
"id": "GHSA-5g3m-2273-p6x6",
"modified": "2026-08-27T06:31:23Z",
"published": "2026-08-19T18:32:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71470"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60386"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60387"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60388"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60389"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60390"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60391"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-71470"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512149"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5J3C-FXMQ-X6VW
Vulnerability from github – Published: 2026-10-13 03:30 – Updated: 2026-10-13 03:30A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Profile Update Handler. The manipulation of the argument usertype_id leads to dynamically-determined object attributes. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
{
"affected": [],
"aliases": [
"CVE-2026-108948"
],
"database_specific": {
"cwe_ids": [
"CWE-913"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-13T02:16:57Z",
"severity": "LOW"
},
"details": "A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Profile Update Handler. The manipulation of the argument usertype_id leads to dynamically-determined object attributes. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
"id": "GHSA-5j3c-fxmq-x6vw",
"modified": "2026-10-13T03:30:34Z",
"published": "2026-10-13T03:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108948"
},
{
"type": "WEB",
"url": "https://code-projects.org"
},
{
"type": "WEB",
"url": "https://github.com/thuong2206/Online-Reviewer-System-Privilege-Escalation"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-108948"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/997820"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/416772"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/416772/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-5Q7C-3GJ2-48QW
Vulnerability from github – Published: 2024-01-12 21:30 – Updated: 2024-01-12 21:30NVIDIA DGX A100 SBIOS contains a vulnerability where a user may cause a dynamic variable evaluation by local access. A successful exploit of this vulnerability may lead to denial of service.
{
"affected": [],
"aliases": [
"CVE-2023-31032"
],
"database_specific": {
"cwe_ids": [
"CWE-627",
"CWE-913"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-12T19:15:10Z",
"severity": "HIGH"
},
"details": "NVIDIA DGX A100 SBIOS contains a vulnerability where a user may cause a dynamic variable evaluation by local access. A successful exploit of this vulnerability may lead to denial of service.",
"id": "GHSA-5q7c-3gj2-48qw",
"modified": "2024-01-12T21:30:19Z",
"published": "2024-01-12T21:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31032"
},
{
"type": "WEB",
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5510"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5R9F-76WQ-X3P4
Vulnerability from github – Published: 2023-09-02 15:30 – Updated: 2024-04-04 07:22A vulnerability that poses a potential risk of polluting the MXsecurity sqlite database and the nsm-web UI has been identified in MXsecurity versions prior to v1.0.1. This vulnerability might allow an unauthenticated remote attacker to register or add devices via the nsm-web application.
{
"affected": [],
"aliases": [
"CVE-2023-39983"
],
"database_specific": {
"cwe_ids": [
"CWE-913",
"CWE-915"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-02T13:15:45Z",
"severity": "MODERATE"
},
"details": "A vulnerability that poses a potential risk of polluting the MXsecurity sqlite database and the nsm-web UI has been identified in MXsecurity versions prior to v1.0.1. This vulnerability might allow an unauthenticated remote attacker to register or add devices via the nsm-web application.\n\n",
"id": "GHSA-5r9f-76wq-x3p4",
"modified": "2024-04-04T07:22:22Z",
"published": "2023-09-02T15:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39983"
},
{
"type": "WEB",
"url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecurity-series-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Input Validation
For any externally-influenced input, check the input against an allowlist of acceptable values.
Mitigation
Strategy: Refactoring
Refactor the code so that it does not need to be dynamically managed.
No CAPEC attack patterns related to this CWE.