Skip to content
Noroxi

CWE-425 · 218 records

Direct Request ('Forced Browsing')

CVEs in this class

218 records

  • CVE-2024-45195
    90Now

    Apache OFBiz: Confused controller-view authorization logic (forced browsing)

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    apache · ofbizSep 4, 2024

  • CVE-2021-26085
    81Now

    Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File

    MediumCVSS 5.3KEVWeaponizedEPSS 99%

    atlassian · confluence data centerAug 2, 2021

  • CVE-2024-0204
    68This week

    Authentication Bypass in GoAnywhere MFT

    CriticalCVSS 9.8WeaponizedEPSS 95%

    fortra · goanywhere managed file transferJan 22, 2024

  • CVE-2018-19207
    65This week

    The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code

    CriticalCVSS 9.8WeaponizedEPSS 88%

    van-ons · wp-gdpr-complianceNov 12, 2018

  • CVE-2017-17736
    60This week

    Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/insta

    CriticalCVSS 9.8Proof of conceptEPSS 68%

    kentico · xperienceMar 23, 2018

  • CVE-2019-12583
    49Plan

    Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest

    CriticalCVSS 9.1Proof of conceptEPSS 43%

    zyxel · uag2100 firmwareJun 27, 2019

  • CVE-2019-16340
    45Plan

    Belkin Linksys Velop 1.1.8.192419 devices allows remote attackers to discover the recovery key via a direct request for the /sysinfo_json.cg

    CriticalCVSS 9.8No exploitEPSS 19%

    linksys · velop whw0303 firmwareNov 21, 2019

  • CVE-2021-40875
    44Plan

    Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure.

    HighCVSS 7.5Proof of conceptEPSS 47%

    gurock · testrailSep 22, 2021

  • CVE-2017-14244
    44Plan

    An authentication bypass vulnerability on iBall Baton ADSL2+ Home Router FW_iB-LR7011A_1.0.2 devices potentially allows attackers to directl

    CriticalCVSS 9.8Proof of conceptEPSS 17%

    iball · ib-wra150n firmwareSep 17, 2017

  • CVE-2021-36745
    42Plan

    A vulnerability in Trend Micro ServerProtect for Storage 6.0, ServerProtect for EMC Celerra 5.8, ServerProtect for Network Appliance Filers

    CriticalCVSS 9.8No exploitEPSS 9%

    trendmicro · serverprotectSep 29, 2021

  • CVE-2018-3774
    41Plan

    Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Aut

    CriticalCVSS 10.0No exploitEPSS 3%

    url-parse project · url-parseAug 12, 2018

  • CVE-2021-46378
    40Plan

    DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an unauthenticated remote configuration downlo

    HighCVSS 7.5Proof of conceptEPSS 31%

    dlink · dir-850l firmwareMar 4, 2022

  • CVE-2022-28799
    40Plan

    The TikTok application before 23.7.3 for Android allows account takeover.

    HighCVSS 8.8No exploitEPSS 16%

    tiktok · tiktokJun 2, 2022

  • CVE-2020-24203
    40Plan

    Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects World Travel Management

    CriticalCVSS 9.8No exploitEPSS 3%

    projectworlds · travel management systemAug 27, 2020

  • CVE-2019-7736
    40Plan

    D-Link DIR-600M C1 3.04 devices allow authentication bypass via a direct request to the wan.htm page.

    CriticalCVSS 9.8No exploitEPSS 2%

    dlink · dir-600m firmwareFeb 11, 2019

  • CVE-2019-9584
    40Plan

    eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability to obtain VPN profile details,

    CriticalCVSS 9.8No exploitEPSS 2%

    eq-3 · homematic ccu2 firmwareAug 14, 2019

  • CVE-2018-18922
    40Plan

    add_user in AbiSoft Ticketly 1.0 allows remote attackers to create administrator accounts via an action/add_user.php POST request.

    CriticalCVSS 9.8No exploitEPSS 2%

    abisoftgt · ticketlyDec 13, 2018

  • CVE-2020-24660
    40Plan

    An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used.

    CriticalCVSS 9.8No exploitEPSS 2%

    lemonldap-ng · lemonldap\Sep 14, 2020

  • CVE-2019-12768
    40Plan

    An issue was discovered on D-Link DAP-1650 devices through v1.03b07 before 1.04B02_J65H Hot Fix.

    CriticalCVSS 9.8No exploitEPSS 2%

    dlink · dap-1650 firmwareDec 30, 2020

  • CVE-2019-9552
    40Plan

    Eloan V3.0 through 2018-09-20 allows remote attackers to list files via a direct request to the p2p/api/ or p2p/lib/ or p2p/images/ URI.

    CriticalCVSS 9.8No exploitEPSS 2%

    eloan project · eloanMar 4, 2019

  • CVE-2022-26279
    40Plan

    EyouCMS v1.5.5 was discovered to have no access control in the component /data/sqldata.

    CriticalCVSS 9.8No exploitEPSS 1%

    eyoucms · eyoucmsMar 24, 2022

  • CVE-2018-6624
    39Monitor

    OMRON NS devices 1.1 through 1.3 allow remote attackers to bypass authentication via a direct request to the .html file for a specific scree

    CriticalCVSS 9.8No exploitEPSS 1%

    omron · ns series firmwareFeb 5, 2018

  • CVE-2021-36560
    39Monitor

    Phone Shop Sales Managements System using PHP with Source Code 1.0 is vulnerable to authentication bypass which leads to account takeover of

    CriticalCVSS 9.8No exploitEPSS 1%

    phone shop sales management system project · phone shop sales management systemNov 2, 2021

  • CVE-2025-26689
    39Monitor

    Direct request ('Forced Browsing') issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions.

    CriticalCVSS 9.8No exploitEPSS 1%

    inaba denki sangyo co., ltd. · choco tei watcher mini (ib-mct001)Mar 31, 2025

  • CVE-2024-24592
    39Monitor

    Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote attacker to arbitrarily

    CriticalCVSS 9.8No exploitEPSS 0%

    clear · clearmlFeb 6, 2024

All vulnerability classes