The product does not properly handle when the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined.
Volume of CVEs assigned to CWE-233 and their average CVSS base score over time.
Top CVEs that have been assigned this CWE. A single CVE can have multiple CWE assignments, though many have just one.
31 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-52970HIGH A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthentica | Aug 12, 2025 | 8.1 | 49 | NO | YES |
CVE-2026-32998CRITICAL This vulnerability in Veeam Service Provider Console allows for remote code execution. | May 28, 2026 | 9.4 | 36 | NO | NO |
CVE-2026-2370HIGH GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations tha | Mar 30, 2026 | 8.8 | 34 | NO | NO |
CVE-2022-45182CRITICAL Pi-Star_DV_Dash (for Pi-Star DV) before 5aa194d mishandles the module parameter. | Nov 11, 2022 | 9.8 | 31 | NO | NO |
CVE-2023-20076HIGH A vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root on the underlying host operatin | Feb 12, 2023 | 8.8 | 28 | NO | NO |
CVE-2026-0515MEDIUM Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a crash of the QNX Neutrino kernel. | Jul 14, 2026 | 6.2 | 27 | NO | NO |
CVE-2023-20514HIGH Improper handling of parameters in the AMD Secure Processor (ASP) could allow a privileged attacker to pass an arbitrary memory value to functions in the trusted execution environm | Feb 11, 2026 | 8.7 | 27 | NO | NO |
CVE-2021-0269HIGH The improper handling of client-side parameters in J-Web of Juniper Networks Junos OS allows an attacker to perform a number of different malicious actions against a target device | Apr 22, 2021 | 8.8 | 26 | NO | NO |
CVE-2024-24525CRITICAL An issue in EpointWebBuilder 5.1.0-sp1, 5.2.1-sp1, 5.4.1 and 5.4.2 allows a remote attacker to execute arbitrary code via the infoid parameter of the URL. | Feb 29, 2024 | 9.8 | 25 | NO | NO |
CVE-2022-3697HIGH A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advan | Oct 28, 2022 | 7.5 | 25 | NO | NO |
Exploit activity across CVEs assigned to this CWE, including CVEs that carry other CWE assignments.
Social posts that mention CVE IDs assigned to this CWE. This is assigned-CVE activity, not mentions of the CWE label itself.
Media articles that mention CVE IDs assigned to this CWE. This is assigned-CVE coverage, not mentions of the CWE label itself.