CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Weakness type from the CWE catalogue

What the weakness means

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Definition as published by MITRE, in English.

76 vulnerabilities in the service point to this weakness

CVE-2021-21985 Actively exploited Critical 9.8

VMware vCenter Server Improper Input Validation Vulnerability

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A mali…
CVE-2026-82078 Actively exploited Critical 9.1

PaperCut NG/MF Unsafe Reflection Vulnerability

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable dr…
CVE-2026-55107 Critical 10.0

Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts (LLM-generated code, user formulas, student submissions, third-par…
CVE-2026-13772 Critical 9.9

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacker-supplied class names via Class.forName() and invokes their constructors with no allow-list at thr…
CVE-2026-78030 Critical 9.8

DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. DBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require witho…
CVE-2026-41871 Critical 9.8

Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from …
CVE-2026-44416 Critical 9.8

Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVE-2026-8400 Critical 9.8

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malic…
CVE-2026-46562 Critical 9.8

Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorit…
CVE-2026-40008 Critical 9.8

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it using …
CVE-2026-42027 Critical 9.8

Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3 Description: The ExtensionLoader.instantiateExtension…
CVE-2025-34393 Critical 9.8

Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not correctly verify the name of an attacker-controlled WSDL service, leading to insecure reflection.…
CVE-2025-53693 Critical 9.8

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning…
CVE-2026-93762 Critical 9.2

Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow…
CVE-2017-20285 Critical 9.1

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the …
CVE-2026-58400 Critical 9.1

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure proc…
CVE-2026-13051 Critical 9.1

Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to add_…
CVE-2022-4993 Critical 9.1

HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data…
CVE-2025-63690 Critical 9.1

In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java class with a paramet…
CVE-2024-4990 Critical 9.1

In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic method does not validate that the value passed is a valid Behavior class name or configurat…
CVE-2024-7059 High 8.9

A high-severity vulnerability that can lead to arbitrary code execution on the system hosting the Web SDK role was found in the Genetec Security Center product line.
CVE-2026-10853 High 8.8

IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster command message lengths.
CVE-2026-61599 High 8.8

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the LiveView to mount from a c…
CVE-2026-86792 High 8.8

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field into Python callables via `import_string`, with no allowlist,…
CVE-2026-41870 High 8.8

Missing Authorization, Improper Control of Generation of Code ('Code Injection'), Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code …

Sources and freshness

CVE

What it is: A reference number naming one specific vulnerability, for example CVE-2024-9474.
What it tells you: Which vulnerability we are talking about, and in which product.
What it does NOT tell you: Nothing about how serious it is, whether anyone is exploiting it, or whether it concerns you.
Why it matters: Without a shared number, vendor, authority and tooling cannot discuss the same flaw.
Used with the others: The number is the key. NVD, KEV and EPSS all describe the same CVE.

NVD CWE CISA KEV EPSS

How to read this together

No single value should be used on its own. A high CVSS score does not mean a vulnerability is being exploited, and a low one does not mean it is harmless. The four sources answer four different questions.

CVE names the specific vulnerability.
NVD adds severity and technical detail about it.
CWE describes the type of mistake behind it.
CISA KEV shows that it is already being exploited.
EPSS estimates how likely exploitation is soon.

The order that decides what is urgent

Do you actually have the product?
Is the version you run affected?
Is it listed in CISA KEV?
Does it have a high EPSS score?
Is the system reachable from the internet or from others?
How important is the system to the business?
Are there compensating controls already in place?

The first two questions are not about the vulnerability at all. They are about you, and they remove most of the list before you start.

A short example

Fix this week

CVSS 6,5 (medium)

In CISA KEV: yes
EPSS: 94 per cent
A firewall facing the internet

Can be scheduled

CVSS 9,8 (critical)

In CISA KEV: no
EPSS: 0,04 per cent
A test server with no internet access

Sorted by CVSS alone, the one on the right comes first. It is the more serious flaw in theory. But the one on the left is being used against real organisations right now, and it sits where an attacker can reach it. That is the one to fix first.

The critical one still has to be fixed. It just does not have to be fixed today.

This product uses the NVD API but is not endorsed or certified by the NVD. CVE and the CVE logo are registered trademarks of The MITRE Corporation; CVE records are used under the CVE Terms of Use. CWE is a trademark of The MITRE Corporation, used per the CWE Terms of Use. KEV data from CISA (CC0). Exploitation probability from EPSS, a FIRST.org project. Open-source package data from OSV and the GitHub Advisory Database (CC-BY 4.0).

Scores and vectors are shown as published by the sources. The ordering of results is Berigo's own editorial assessment, described on the search page, and is not NVD data. An empty result never means a system is safe.