Skip to content
OpenAdvisories

Weakness (CWE)

CWE-425: Direct Request

Base Incomplete

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

How to prevent it (2 mitigations)

  1. Architecture and Design, Operation

    Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files.

  2. Architecture and Design

    Consider using MVC based frameworks such as Struts.

Source: MITRE CWE-425

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-22732 Public exploit

    Under Some Conditions Spring Security HTTP Headers Are not Written

    When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written.  This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP H…

    VMware Spring Security org.springframework.security:spring-security-web Maven
  • Critical 9.8
    CVE-2022-43110 Public exploit

    Voltronic Power ViewPower through 1.04-21353 and PowerShield Netguard before 1.04-23292 allows a remote attacker to con…

  • Critical 9.8
    CVE-2024-45195 Exploited Public exploit EPSS 100%

    Apache OFBiz: Confused controller-view authorization logic (forced browsing)

    Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.

    Apache Software Foundation Apache OFBiz
    KEV Feb 4, 2025
  • Critical 9.8
    CVE-2024-0204 Public exploit EPSS 95%

    Authentication Bypass in GoAnywhere MFT

    Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.

    Fortra GoAnywhere MFT