CWE-471

Modification of Assumed-Immutable Data (MAID)

BaseDraft

Description

The product does not properly protect an assumed-immutable element from being modified by an attacker.

This occurs when a particular input is critical enough to the functioning of the application that it should not be modifiable at all, but it is. Certain resources are often assumed to be immutable when they are not, such as hidden form fields in web applications, cookies, and reverse DNS lookups.

Hierarchy (View 1000)

Parents

CWE-664

Children

Related attack patterns (CAPEC)

CAPEC-384 · CAPEC-385 · CAPEC-386 · CAPEC-387 · CAPEC-388

CVEs mapped to this weakness (43)

page 3 of 3

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2026-8492	Gtranslate Gtranslate	Low	0.18	2.7	0.00	May 19, 2026	Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with GTranslate allows Resource Location Spoofing. This issue affects Translate Drupal with GTranslate: from 0.0.0 before 3.0.5.
CVE-2023-46232	Matter Labs Zkvyper	Med	0.00	5.3	0.01	Oct 25, 2023	era-compiler-vyper is the EraVM Vyper compiler for zkSync Era, a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to era-compiler-vype version 1.3.10, a bug prevented the initialization of the first immutable variable for Vyper contracts meeting certain…
CVE-2011-4301	Moodle Moodle		0.00	—	0.02	Jul 11, 2012	The MoodleQuickForm class in the Forms Library in lib/formslib.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not recognize Forms API setConstant operations, which allows remote attackers to submit unexpected form content by modifying the…

CVE-2026-8492LowMay 19, 2026
Gtranslate
Gtranslate
risk 0.18cvss 2.7epss 0.00
Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with GTranslate allows Resource Location Spoofing. This issue affects Translate Drupal with GTranslate: from 0.0.0 before 3.0.5.
CVE-2023-46232MedOct 25, 2023
Matter Labs
Zkvyper
risk 0.00cvss 5.3epss 0.01
era-compiler-vyper is the EraVM Vyper compiler for zkSync Era, a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to era-compiler-vype version 1.3.10, a bug prevented the initialization of the first immutable variable for Vyper contracts meeting certain…
CVE-2011-4301Jul 11, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.02
The MoodleQuickForm class in the Forms Library in lib/formslib.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not recognize Forms API setConstant operations, which allows remote attackers to submit unexpected form content by modifying the…