Skip to content
OpenAdvisories

Weakness (CWE)

CWE-425: Direct Request

Base Incomplete

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

How to prevent it (2 mitigations)

  1. Architecture and Design, Operation

    Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files.

  2. Architecture and Design

    Consider using MVC based frameworks such as Struts.

Source: MITRE CWE-425

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-29909 Public exploit

    MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module. The /admin/…

  • Medium 5.0
    CVE-2025-47226 Public exploit

    Grokability Snipe-IT has incorrect authorization for accessing asset information

    Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.

    Snipeitapp Snipe-IT snipe/snipe-it Packagist
  • Medium 4.3
    CVE-2025-27581 Public exploit

    NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users who lack the InET role …

    NIH BRICS
  • Medium 4.3
    CVE-2023-5702 Public exploit EPSS 19%

    Viessmann Vitogate 300 direct request

    A vulnerability was found in Viessmann Vitogate 300 up to 2.1.3.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /cgi-bin/. The manipulation leads to direct request. The exploit has been disclosed to the public…

    Viessmann Vitogate 300
  • Medium 5.3
    CVE-2021-26085 Exploited · Ransomware Public exploit EPSS 100%

    Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authoriz…

    Atlassian Confluence Server Confluence Data Center Web / CMS
    KEV Mar 28, 2022