CWE-425: Direct Request
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
Also known as Forced Browsing.
A kind of CWE-862 Missing Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- mintlify, mintlify platform +1 moreThe GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote attackers to...5.0 Medium
- wodesys wd-r608u, wdr122b v2.0, wdr28 +2 moreUnauthorized Access to files in WODESYS WD-R608U router7.1 High
- johnson controls openblue workplace (formerly fm systems)OpenBlue Mobile Web Application configuration issue for optional for OpenBlue Workplace (formerly FM Systems)6.5 Medium
- shenzhen sixun software sixun shanghui group business management systemShenzhen Sixun Software Sixun Shanghui Group Business Management System ExportFiles file access6.3 Medium
- fortinet fortiauthenticatorA direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6...2.6 Low
- gitlabDirect Request ('Forced Browsing') in GitLab4.3 Medium
- frappe learning, lms +1 moreFrappe Learning allowed students to access the Quiz Form via direct URL1.3 Low
- frappe lms, learning +1 moreFrappe LMS Assignment Picture files direct request6.3 Medium
- profession fit fitProfession Fit 5.0.99 Build 44910 allows authorization bypass via a direct request for /api...5.8 Medium
- roncoo roncoo-payroncoo roncoo-pay orderQuery direct request2.3 Low
- hcl software aiml solutions for sxAIML Solutions for HCL SX is susceptible to a URL validation vulnerability5.1 Medium
- No product listedVoltronic Power ViewPower through 1.04-21353 and PowerShield Netguard before 1.04-23292 allows a...9.8 Critical
- dogukanurker flaskblogflaskBlog allows arbitrary privilege escalation9.3 Critical
- iroha soft co., ltd. board, irohasoft iroha board +1 moreDirect request ('Forced Browsing') issue exists in iroha Board versions v0.10.12 and earlier. If...5.3 Medium
- sentryIn Sentry 25.1.0 through 25.5.1, an authenticated attacker can access a project's issue endpoint...4.2 Medium
- innocommerce innoshopInnoshop through 0.4.1 allows Insecure Direct Object Reference (IDOR) at multiple places within...6.4 Medium
- code-projects automated voting systemcode-projects Automated Voting System Backend vote.php direct request6.9 Medium
- typo3 reint downloadmanager extensionreint_downloadmanager TYPO3 Extension is susceptible to Insecure Direct Object Reference8.6 High
- typo3 sr feuser register extensionThe Front End User Registration extension for TYPO3 (sr_feuser_register) allows Insecure Direct Object Reference8.6 High
- typo3 femanager extensionThe femanager TYPO3 extension allows Insecure Direct Object Reference5.3 Medium
- typo3 ns backup extensionThe Backup Plus extension for TYPO3 (ns_backup) has a Predictable Resource Location8.6 High
- grokability, inc. snipe-itGrokability Snipe-IT has incorrect authorization for accessing asset information5.0 Medium
- ververica platformVerverica Platform 2.14.0 allows low-privileged users to access SQL connectors via a direct...5.0 Medium
- codesys visualizationForced Browsing Vulnerability in CODESYS Visualization5.3 Medium
- nih bricsNIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users...4.3 Medium
- oz forensics face recognition applicationThe Oz Forensics face recognition application before 4.0.8 late 2023 allows PII retrieval via ...8.6 High
- inaba denki sangyo co., ltd. choco tei watcher mini (ib-mct001)Direct request ('Forced Browsing') issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all...9.8 Critical
- infonet projekt sa oxari servicedeskImproper permission control in OXARI ServiceDesk9.3 Critical
- beijing zhide intelligent internet technology modern farm digital integrated management systemBeijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System file access6.9 Medium
- grocy project grocyGrocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests...4.3 Medium
- fortra goanywhere mftLimited Information Disclosure in GoAnywhere MFT Prior to 7.7.05.3 Medium
- zkteco zkbio timeZKTeco ZKBio Time Image File photo direct request6.3 Medium
- apache ofbizApache OFBiz: Confused controller-view authorization logic (forced browsing)7.5 High
- clinics patient management system project patient management system, sourcecodester clinics patient management system, oretnom23 clinic\'s patient management system +2 moreSourceCodester Clinics Patient Management System user_images direct request6.9 Medium
- vonets vap11ac, vap11ac firmware, vap11g +25 more +27 moreVonets WiFi Bridges Forced Browsing6.1 Medium
- hms-networks ewon cosy\+ firmware, ewon cosy firmware +1 moreA compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request...9.1 Critical
- netgear wn604, wn604 firmware +1 moreNetgear WN604 siteSurvey.php direct request6.9 Medium
- insurance management system project management system, itsourcecode insurance management system +1 moreSourceCodester Insurance Management System direct request6.9 Medium
- siemens sinema remote connect serverA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1)....7.2 High
- siemens sinema remote connect serverA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1)....7.2 High
- parsec automation traksys, tracksys +1 moreParsec Automation TrakSYS Export Page contentpage direct request6.9 Medium
- parsec automation tracksysParsec Automation TrackSYS pagedefinition direct request6.9 Medium
silverstripe/frameworkPackagistSilverstripe Missing security check on dev/build/defaults6.5 Mediumsilverstripe/forumPackagistSilverstripe Forum Module CSRF Vulnerability5.3 Medium- mauticPredictable Page Indexing Might Lead to Sensitive Data Exposure in Mautic5.3 Medium
- ailux imx6, imx6 bundle +1 moreA CWE-862 “Missing Authorization” vulnerability in the “measure” functionality of the web...5.3 Medium
- ailux imx6, imx6 bundle +1 moreA CWE-862 “Missing Authorization” vulnerability in the “file_configuration” functionality of the...5.3 Medium
- gitlabDirect Request ('Forced Browsing') in GitLab4.3 Medium
- ibm jazz for service managementIBM Jazz for Service Management information disclosure5.3 Medium
- allegro.ai clearmlLack of authentication in all versions of the fileserver component of Allegro AI’s ClearML...9.8 Critical
- Show moreLoading…