Weakness (CWE)
CWE-425: Direct Request
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files.
-
Architecture and Design
Consider using MVC based frameworks such as Struts.
Source: MITRE CWE-425
14 results · Clear filters · Feed
-
Critical 9.1
Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations
A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring sec…
-
Critical 9.1CVE-2026-22732 Public exploit
Under Some Conditions Spring Security HTTP Headers Are not Written
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP H…
-
Critical 9.4
A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testi…
-
Critical 9.3CVE-2026-0650 Scanner template
OpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path Normalization
OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normalization in the whitelist logic, crafted requests can bypass authentication and access protected API …
-
Critical 9.8CVE-2022-43110 Public exploit
Voltronic Power ViewPower through 1.04-21353 and PowerShield Netguard before 1.04-23292 allows a remote attacker to con…
-
Critical 9.3
flaskBlog allows arbitrary privilege escalation
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, an arbitrary user can change his role to "admin", giving its relative privileges (e.g. delete users, posts, comments etc.). The problem is in the routes/adminPanelUsers file.
-
Critical 9.8
Direct request ('Forced Browsing') issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If a remote attacke…
-
Critical 9.3
Improper permission control in OXARI ServiceDesk
Improper permission control vulnerability in the OXARI ServiceDesk application could allow an attacker using a guest access or an unprivileged account to gain additional administrative permissions in the application.This issue affects OXARI ServiceDesk in ver…
-
Critical 9.8
Apache OFBiz: Confused controller-view authorization logic (forced browsing)
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.
KEV Feb 4, 2025 -
Critical 9.1
A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another …
-
Critical 9.8
Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote att…
-
Critical 9.8
Authentication Bypass in GoAnywhere MFT
Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.
-
Critical 9.8
An issue in the /index/user/user_edit.html component of YJCMS v1.0.9 allows unauthenticated attackers to obtain the Adm…
-
Critical 10.0
Open Redirect in url-parse
Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.