CWE-425— Direct Request ('Forced Browsing')
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.— MITRE CWE catalog
223 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-425page 1 of 5
- CVE-2002-1798CRITICALCVSS 9.1EG 9.12002-12-31
MidiCart PHP, PHP Plus, and PHP Maxi allows remote attackers to (1) upload arbitrary php files via a direct request to admin/upload.php or (2) access sensitive information via a direct request to admin/credit_card_info.php.
- CVE-2004-2144NONECVSS 0.0EG 0.02004-12-31
Baal Smart Forms before 3.2 allows remote attackers to bypass authentication and obtain system access via a direct request to regadmin.php.
- CVE-2004-2257MEDIUMCVSS 5.3EG 5.32004-12-31
phpMyFAQ 1.4.0 allows remote attackers to access the Image Manager to upload or delete images without authorization via a direct request.
- CVE-2005-1654NONECVSS 0.0EG 0.02005-05-18
Hosting Controller 6.1 Hotfix 1.9 and earlier allows remote attackers to register arbitrary users via a direct request to addsubsite.asp with the loginname and password parameters set.
- CVE-2005-1668NONECVSS 0.0EG 0.02005-05-18
YusASP Web Asset Manager 1.0 allows remote attackers to gain privileges via a direct request to assetmanager.asp.
- CVE-2005-1685NONECVSS 0.0EG 0.02005-05-20
episodex guestbook allows remote attackers to bypass authentication and edit scripts via a direct request to admin.asp.
- CVE-2005-1688MEDIUMCVSS 5.3EG 5.32005-05-20
Wordpress 1.5 and earlier allows remote attackers to obtain sensitive information via a direct request to files in (1) wp-content/themes/, (2) wp-includes/, or (3) wp-admin/, which reveal the path in an error message.
- CVE-2005-1697NONECVSS 0.0EG 0.02005-05-24
The RSS module in PostNuke 0.750 and 0.760RC2 and RC3 allows remote attackers to obtain sensitive information via a direct request to simple_smarty.php, which reveals the path in an error message.
- CVE-2005-1698NONECVSS 0.0EG 0.02005-05-24
PostNuke 0.750 and 0.760RC3 allows remote attackers to obtain sensitive information via a direct request to (1) theme.php or (2) Xanthia.php in the Xanthia module, (3) user.php, (4) thelang.php, (5) text.php, (6) html.php, (7) menu.php, (8…
- CVE-2005-1827NONECVSS 0.0EG 0.02005-05-26
D-Link DSL-504T allows remote attackers to bypass authentication and gain privileges, such as upgrade firmware, restart the router or restore a saved configuration, via a direct request to firmwarecfg.
- CVE-2005-1892NONECVSS 0.0EG 0.02005-06-09
FlatNuke 2.5.3 allows remote attackers to cause a denial of service or obtain sensitive information via (1) a direct request to foot_news.php, which triggers an infinite loop, or (2) direct requests to unknown scripts, which reveals the we…
- CVE-2015-1313MEDIUMCVSS 6.5EG 6.52023-06-29
JetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a crafted request because the required request data can be deduced by reading HTML and JavaScript files that are returned to the web browser after a…
- CVE-2016-1000111MEDIUMCVSS 5.3EG 5.32020-03-11
Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might al…
- CVE-2017-14993HIGHCVSS 7.5EG 7.52018-02-20
OXID eShop Community Edition before 6.0.0 RC3 (development), 4.10.x before 4.10.6 (maintenance), and 4.9.x before 4.9.11 (legacy), Enterprise Edition before 6.0.0 RC3 (development), 5.2.x before 5.2.11 (legacy), and 5.3.x before 5.3.6 (mai…
- CVE-2017-17736CRITICALCVSS 9.8EG 9.82018-03-23
Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.
- CVE-2018-0105MEDIUMCVSS 5.3EG 5.32018-01-18
A vulnerability in the web framework of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view sensitive data. The vulnerability is due to insufficient protection of database tables. An attacker could …
- CVE-2018-0140MEDIUMCVSS 6.5EG 6.52018-02-08
A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote attacker to download any message from the spam quarantine by modifying browser st…
- CVE-2018-0198MEDIUMCVSS 5.3EG 5.32018-03-27
A vulnerability in the web framework of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view sensitive data. The vulnerability is due to insufficient protection of database tables. An attacker could …
- CVE-2018-0266MEDIUMCVSS 4.3EG 4.32018-04-19
A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view sensitive data. The vulnerability is due to insufficient protection of database tables over the web interfac…
- CVE-2018-0267MEDIUMCVSS 6.5EG 6.52018-04-19
A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, local attacker to view sensitive data that should be restricted. This could include LDAP credentials. The vulnerability is due to in…
- CVE-2018-11346MEDIUMCVSS 4.3EG 4.32018-05-22
An insecure direct object reference vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows the ability to reference the "download_sys_settings" action and then specify files arbitrarily throughout the system via the act par…
- CVE-2018-16060HIGHCVSS 7.5EG 7.52021-10-15
Mitsubishi Electric Europe B.V. SmartRTU devices allow remote attackers to obtain sensitive information (directory listing and source code) via a direct request to the /web URI.
- CVE-2018-16706HIGHCVSS 7.5EG 7.52018-09-14
LG SuperSign CMS allows TVs to be rebooted remotely without authentication via a direct HTTP request to /qsr_server/device/reboot on port 9080.
- CVE-2018-18862HIGHCVSS 8.8EG 8.82019-03-21
BMC Remedy Mid-Tier 7.1.00 and 9.1.02.003 for BMC Remedy AR System has Incorrect Access Control in ITAM forms, as demonstrated by TLS%3APLR-Configuration+Details/Default+Admin+View/, AST%3AARServerConnection/Default+Admin+View/, and AR+Sys…
- CVE-2018-18922CRITICALCVSS 9.8EG 9.82018-12-13
add_user in AbiSoft Ticketly 1.0 allows remote attackers to create administrator accounts via an action/add_user.php POST request.
- CVE-2018-19109HIGHCVSS 8.8EG 8.82018-11-08
tianti 2.3 allows remote authenticated users to bypass intended permission restrictions by visiting tianti-module-admin/cms/column/list directly to read the column list page or edit a column.
- CVE-2018-19143MEDIUMCVSS 6.5EG 6.52018-11-11
Open Ticket Request System (OTRS) 4.0.x before 4.0.33, 5.0.x before 5.0.31, and 6.0.x before 6.0.13 allows an authenticated user to delete files via a modified submission form because upload caching is mishandled.
- CVE-2018-19207CRITICALCVSS 9.8EG 9.82018-11-12
The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code because $wpdb->prepare() input is mishandled, as exploited in the wild in November 2018.
- CVE-2018-19620MEDIUMCVSS 4.3EG 4.32018-11-28
ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified page_id.
- CVE-2018-3774CRITICALCVSS 10.0EG 10.02018-08-12
Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.
- CVE-2018-6624CRITICALCVSS 9.8EG 9.82018-02-05
OMRON NS devices 1.1 through 1.3 allow remote attackers to bypass authentication via a direct request to the .html file for a specific screen, as demonstrated by monitor.html.
- CVE-2018-6669MEDIUMCVSS 6.3EG 8.02018-12-20
A whitelist bypass vulnerability in McAfee Application Control / Change Control 7.0.1 and before allows a remote or local user to execute blacklisted files through an ASP.NET form.
- CVE-2018-7526HIGHCVSS 7.5EG 7.52018-05-24
In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, by accessing a specific uniform resource locator (URL) on the webserver, a malicious user may be able to access information in the applicatio…
- CVE-2019-11326HIGHCVSS 8.8EG 8.82019-09-20
An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product is protected by a login. A guest is allowed to login. Once logged in as a guest, an attacker can browse a URL …
- CVE-2019-1220MEDIUMCVSS 4.3EG 4.32019-09-11
A security feature bypass vulnerability exists when Microsoft Browsers fail to validate the correct Security Zone of requests for specific URLs, aka 'Microsoft Browser Security Feature Bypass Vulnerability'.
- CVE-2019-12583CRITICALCVSS 9.1EG 9.12019-06-27
Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access…
- CVE-2019-12768CRITICALCVSS 9.8EG 9.82020-12-30
An issue was discovered on D-Link DAP-1650 devices through v1.03b07 before 1.04B02_J65H Hot Fix. Attackers can bypass authentication via forceful browsing.
- CVE-2019-13030HIGHCVSS 8.2EG 8.22019-08-14
eQ-3 Homematic CCU3 AddOn 'Mediola NEO Server for Homematic CCU3' prior to 2.4.5 allows uncontrolled admin access to start or stop the Node.js process, resulting in the ability to obtain mediola configuration details. This is related to im…
- CVE-2019-13981MEDIUMCVSS 5.3EG 5.32019-07-19
In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads/_/originals/ directory. This is related to a configuration option in which the file collection can be non-public, …
- CVE-2019-14347HIGHCVSS 8.8EG 8.82019-08-06
Internal/Views/addUsers.php in Schben Adive 2.0.7 allows remote unprivileged users (editor or developer) to create an administrator account via admin/user/add, as demonstrated by a Python PoC script.
- CVE-2019-14927HIGHCVSS 7.5EG 7.52019-10-28
An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote configuration download vulnerability allows an attacker to download the smartRTU's config…
- CVE-2019-16340CRITICALCVSS 9.8EG 9.82019-11-21
Belkin Linksys Velop 1.1.8.192419 devices allows remote attackers to discover the recovery key via a direct request for the /sysinfo_json.cgi URI.
- CVE-2019-16386MEDIUMCVSS 4.3EG 4.32019-11-26
PEGA Platform 7.x and 8.x is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyActivity=GetWebInfo&target=popup&pzHarnessID=random_harness_id request to get database schema information while using a low-p…
- CVE-2019-16388MEDIUMCVSS 4.3EG 4.32019-11-26
PEGA Platform 8.3.0 is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyStream=MyAlerts request to get Audit Log information while using a low-privilege account. NOTE: The vendor states that this vulnera…
- CVE-2019-17503MEDIUMCVSS 5.3EG 9.02019-10-11
An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. An unauthenticated user can access /osm/REGISTER.cmd (aka /osm_tiles/REGISTER.cmd) directly: it contains sensitive information about the database through the SQL …
- CVE-2019-17643HIGHCVSS 7.5EG 7.52020-03-04
An issue was discovered in Centreon before 2.8-30,18.10-8, 19.04-5, and 19.10-2. It provides sensitive information via an unauthenticated direct request for include/monitoring/recurrentDowntime/GetXMLHost4Services.php.
- CVE-2019-17644HIGHCVSS 7.5EG 7.52020-03-04
An issue was discovered in Centreon before 2.8-30, 18.10-8, 19.04-5, and 19.10-2.. It provides sensitive information via an unauthenticated direct request for include/configuration/configObject/host/refreshMacroAjax.php.
- CVE-2019-17645HIGHCVSS 7.5EG 7.52020-03-05
An issue was discovered in Centreon before 2.8.31, 18.10.9, 19.04.6, and 19.10.3. It provides sensitive information via an unauthenticated direct request for include/configuration/configObject/service/refreshMacroAjax.php.
- CVE-2019-17646HIGHCVSS 7.5EG 7.52020-03-05
An issue was discovered in Centreon before 18.10.8, 19.04.5, and 19.10.2. It provides sensitive information via an unauthenticated direct request for api/external.php?object=centreon_metric&action=listByService.
- CVE-2019-1898MEDIUMCVSS 5.3EG 5.32019-06-20
A vulnerability in the web-based management interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to access the syslog file on an affected device. The vulnerability is due to improper authori…
Map vulnerabilities like CWE-425 to your infrastructure
EchelonGraph correlates every CVE — across CWE-425 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Start Free Scan →