CWE-349— Acceptance of Extraneous Untrusted Data With Trusted Data
The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.— MITRE CWE catalog
62 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-349page 2 of 2
- CVE-2024-34083MEDIUMCVSS 5.4EG 5.42024-05-18
aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted con…
- CVE-2025-11703MEDIUMCVSS 5.3EG 5.32025-10-18
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 9.0.48. This is due to the plugin not serving cached data from server-side responses and instead relying o…
- CVE-2023-5548MEDIUMCVSS 5.3EG 5.32023-11-09
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection.
- CVE-2026-54625MEDIUMCVSS 4.8EG 4.82026-08-20
django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key functio…
- CVE-2026-100755MEDIUMCVSS 4.6EG 4.62026-10-13
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain deployment configurations, could have allowed an authenticated user to poison cac…
- CVE-2026-15387MEDIUMCVSS 4.3EG 4.32026-08-26
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have influen…
- CVE-2025-46339MEDIUMCVSS 4.3EG 4.32025-06-04
FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to poison feed favicons by adding a given URL as a feed with the proxy set to an attacker-controlled one and disabled SSL verifying. The favicon hash is …
- CVE-2025-20255MEDIUMCVSS 4.3EG 4.32025-05-21
A vulnerability in client join services of Cisco Webex Meetings could allow an unauthenticated, remote attacker to manipulate cached HTTP responses within the meeting join service. This vulnerability is due to improper handling of malic…
- CVE-2026-41354LOWCVSS 3.7EG 3.72026-04-23
OpenClaw before 2026.4.2 contains an insufficient scope vulnerability in Zalo webhook replay dedupe keys that allows legitimate events from different conversations or senders to collide. Attackers can exploit weak deduplication scoping to …
- CVE-2024-21094LOWCVSS 3.7EG 3.72024-04-16
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22, 17.0.10, 2…
- CVE-2026-62364LOWCVSS 2.3EG 2.32026-09-22
wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLC_KE…
- CVE-2025-1680UnratedEG not assessed2025-10-23
An acceptance of extraneous untrusted data with trusted data vulnerability has been identified in Moxa’s Ethernet switches, which allows attackers with administrative privileges to manipulate HTTP Host headers by injecting a specially cr…
Map vulnerabilities like CWE-349 to your infrastructure
EchelonGraph correlates every CVE — across CWE-349 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →