Use of Externally-Controlled Input to Select Classes or Code
CWE-470
The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
An attacker could supply values to select unexpected classes or methods. If this occurs, then the attacker could create control flow paths that were not intended by the developer. These paths could bypass authentication or access control checks, or otherwise cause the product to behave in an unexpected manner. This situation becomes a doomsday scenario if the attacker can upload files into a location that appears on the product's classpath (CWE-427) or add new entries to the product's classpath (CWE-426). Under either of these conditions, the attacker can use reflection to introduce new, malicious behavior into the product.
We track 102 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.5. 2 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Refactor your code to avoid using reflection.
- Architecture and Design: Do not use user-controlled inputs to select and load classes or code.
- Implementation: Apply strict input validation by using allowlists or indirect selection to ensure that the user is only selecting allowable classes or code.
Latest Use of Externally-Controlled Input to Select Classes or Code vulnerabilities
- 9.8 Critical severity
Sitecore Experience Manager (XM): Use of Externally-Controlled Input to Select Classes or Code
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9.
- 7.5 High severity
Telerik UI for ASP.NET AJAX: Use of Externally-Controlled Input to Select Classes or Code
In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may lead to an unhandled exception resulting in a crash of the hosting process and denial of service.
- 7.6 High severity
generator-jhipster-entity-audit: Use of Externally-Controlled Input to Select Classes or Code
generator-jhipster-entity-audit is a JHipster module to enable entity audit and audit log page. Prior to 5.9.1, generator-jhipster-entity-audit allows unsafe reflection when having Javers selected as Entity Audit Framework. If an attacker manages to place some
- 8.7 High severity
Xperience: Use of Externally-Controlled Input to Select Classes or Code
An unsafe reflection vulnerability in Kentico Xperience allows an unauthenticated attacker to kill the current process, leading to a Denial-of-Service condition. This issue affects Xperience: through 13.0.180.
- 9.1 Critical severity
yiisoft/yii2: Use of Externally-Controlled Input to Select Classes or Code
In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic method does not validate that the value passed is a valid Behavior class name or configuration. This allows an attacker to instantiate arbitrary classes
- 8.2 High severity
addressing: Use of Externally-Controlled Input to Select Classes or Code
The Addressing GLPI plugin enables you to create IP reports for visualize IP addresses used and free on a given network.. Starting with 3.0.0 and before 3.0.3, a poor security check allows an unauthenticated attacker to determine whether data exists (by name)
- 8.0 High severity
Genetec Security Center: Use of Externally-Controlled Input to Select Classes or Code
A high-severity vulnerability that can lead to arbitrary code execution on the system hosting the Web SDK role was found in the Genetec Security Center product line.
- 7.8 High severity
Telerik Reporting: Use of Externally-Controlled Input to Select Classes or Code
In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible using object injection via insecure expression evaluation.
- 7.2 High severity
Telerik Reporting: Use of Externally-Controlled Input to Select Classes or Code
In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability.
- 8.8 High severity
Telerik Reporting: Use of Externally-Controlled Input to Select Classes or Code
In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible through object injection via an insecure type resolution vulnerability.
- 9.8 Critical severity
Telerik Reporting: Use of Externally-Controlled Input to Select Classes or Code
In Progress® Telerik® Reporting versions prior to 18.1.24.709, a code execution attack is possible through object injection via an insecure type resolution vulnerability.
- 8.8 High severity
stimulus_reflex: Use of Externally-Controlled Input to Select Classes or Code
stimulus_reflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being ab
- 9.8 Critical severity
EZSocket: Use of Externally-Controlled Input to Select Classes or Code
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Version1(GOT1000) versions 1.325P and prior, GT Designer3 Version1(GOT2000) versions
- 9.8 Critical severity
Enterprise Server: Use of Externally-Controlled Input to Select Classes or Code
An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need
- 8.8 High severity
Experience Platform: Use of Externally-Controlled Input to Select Classes or Code
Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /sitecore/shell/Invoke.aspx.
- 8.8 High severity
avo: Use of Externally-Controlled Input to Select Classes or Code
Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote cod
- 8.8 High severity
IdentityIQ: Use of Externally-Controlled Input to Select Classes or Code
IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow an authenticated user to invoke
- 7.3 High severity
YouTube Android Player API SDK: Use of Externally-Controlled Input to Select Classes or Code
The YouTube Embedded 1.2 SDK binds to a service within the YouTube Main App. After binding, a remote context is created with the flags Context.CONTEXT_INCLUDE_CODE | Context.CONTEXT_IGNORE_SECURITY. This allows the client app to remotely load code from YouTube
- 9.8 Critical severity
hsqldb: Use of Externally-Controlled Input to Select Classes or Code
Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath res
- 7.8 High severity
MT6580, MT6735, MT6737, MT6739, MT6761…: Use of Externally-Controlled Input to Select Classes or Code
In MtkEmail, there is a possible escalation of privilege due to fragment injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07216598; Issue
- 8.0 High severity
Groupware: Use of Externally-Controlled Input to Select Classes or Code
Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects.
- 9.8 Critical severity
VMware vCenter Server Improper Input Validation Exploited
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this