CWE-425: Direct Request
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
Also known as Forced Browsing.
A kind of CWE-862 Missing Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- apple safari, iphone os +1 moreAn issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10...6.5 Medium
- twistedForced Browsing in Twisted5.3 Medium
- trendmicro deep discovery inspectorTrend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software...5.5 Medium
- flatnukeFlatNuke 2.5.3 allows remote attackers to cause a denial of service or obtain sensitive...6.4 Medium
- dlink dsl-504t firmwareD-Link DSL-504T allows remote attackers to bypass authentication and gain privileges, such as...7.5 High
- postnukePostNuke 0.750 and 0.760RC3 allows remote attackers to obtain sensitive information via a direct...5.0 Medium
- postnukeThe RSS module in PostNuke 0.750 and 0.760RC2 and RC3 allows remote attackers to obtain sensitive...5.0 Medium
- wordpressWordpress 1.5 and earlier allows remote attackers to obtain sensitive information via a direct...5.0 Medium
- episodex guestbookepisodex guestbook allows remote attackers to bypass authentication and edit scripts via a direct...7.5 High
- yusasp web asset managerYusASP Web Asset Manager 1.0 allows remote attackers to gain privileges via a direct request to...7.5 High
- hostingcontroller hosting controllerHosting Controller 6.1 Hotfix 1.9 and earlier allows remote attackers to register arbitrary users...7.5 High
- phpmyfaqphpMyFAQ 1.4.0 allows remote attackers to access the Image Manager to upload or delete images...5.0 Medium
- baalsystems baal smart formsBaal Smart Forms before 3.2 allows remote attackers to bypass authentication and obtain system...7.5 High
- midicart php, php maxi, php plus +2 moreMidiCart PHP, PHP Plus, and PHP Maxi allows remote attackers to (1) upload arbitrary php files...9.1 Critical