Skip to content
OpenAdvisories

Weakness (CWE)

CWE-749: Exposed Dangerous Method or Function

Base Incomplete

The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

More detail

Many different kinds of technologies effectively provide access to methods or functions, such as ActiveX controls, Java functions, IOCTLs, and so on.

The exposure can occur in a few different ways:

- The function/method was never intended to be exposed to outside actors.

- The function/method was only intended to be accessible to a limited set of actors, such as Internet-based access from a single web site.

How to prevent it (2 mitigations)

  1. Architecture and Design

    If you must expose a method, make sure to perform input validation on all arguments, limit access to authorized parties, and protect against all possible vulnerabilities.

  2. Architecture and Design, Implementation

    Identify all exposed functionality. Explicitly list all functionality that must be exposed to some user or set of users. Identify which functionality may be:

    - accessible to all users

    - restricted to a small set of privileged users

    - prevented from being directly accessible at all

    Ensure that the implemented code follows these expectations. This includes setting the appropriate access modifiers where applicable (public, private, protected, etc.) or not marking ActiveX controls safe-for-scripting.

Source: MITRE CWE-749

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.8
    CVE-2026-45805 Public exploit

    Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

    Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP's mcp/packages/server/src/ReplServer.ts bound the ReplServer to 0.0.0.0:4403 and exposed an unauthenticated /execute endpoint that passed the code field to Plu…

    penpot penpot @penpot/mcp npm
  • High 8.5
    CVE-2026-5173 Public exploit

    Exposed Dangerous Method or Function in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to invoke unintended server-side methods through websocket connections …

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 8.8
    CVE-2026-22812 Public exploit EPSS 17%

    OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution

    OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This …

    anomalyco opencode opencode-ai npm
  • High 7.8
    CVE-2023-27363 Public exploit EPSS 42%

    Foxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution Vulnerability

    Foxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulne…

    Foxit PDF Reader