CWE-425 · Direct Request (Forced Browsing)

237 CVEs classified under CWE-425 (Direct Request (Forced Browsing)). Browse by severity and year.

Top CVEs for CWE-425
CVESeverityScorePublishedSummary
CVE-2018-3774Critical10.02018-08-12Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protoco…
CVE-2022-43110Critical9.82025-08-22Voltronic Power ViewPower through 1.04-21353 and PowerShield Netguard before 1.04-23292 allows a remote attacker to configure the system via an unspecified web…
CVE-2025-26689Critical9.82025-03-31Direct request ('Forced Browsing') issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If a remote attacker sends a specially crafted HTTP request…
CVE-2024-24592Critical9.82024-02-06Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote attacker to arbitrarily access, create, mod…
CVE-2024-0204Critical9.82024-01-22Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.
CVE-2022-45276Critical9.82022-11-23An issue in the /index/user/user_edit.html component of YJCMS v1.0.9 allows unauthenticated attackers to obtain the Administrator account password.
CVE-2022-26279Critical9.82022-03-24EyouCMS v1.5.5 was discovered to have no access control in the component /data/sqldata.
CVE-2021-36560Critical9.82021-11-02Phone Shop Sales Managements System using PHP with Source Code 1.0 is vulnerable to authentication bypass which leads to account takeover of the admin.
CVE-2021-36745Critical9.82021-09-29A vulnerability in Trend Micro ServerProtect for Storage 6.0, ServerProtect for EMC Celerra 5.8, ServerProtect for Network Appliance Filers 5.8, and ServerProt…
CVE-2021-24215Critical9.82021-04-12An Improper Access Control vulnerability was discovered in the Controlled Admin Access WordPress plugin before 1.5.2. Uncontrolled access to the website custom…
CVE-2019-12768Critical9.82020-12-30An issue was discovered on D-Link DAP-1650 devices through v1.03b07 before 1.04B02_J65H Hot Fix. Attackers can bypass authentication via forceful browsing.
CVE-2020-24660Critical9.82020-09-14An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submi…
CVE-2020-24203Critical9.82020-08-27Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects World Travel Management System v1.0 allows…
CVE-2019-16340Critical9.82019-11-21Belkin Linksys Velop 1.1.8.192419 devices allows remote attackers to discover the recovery key via a direct request for the /sysinfo_json.cgi URI.
CVE-2019-9584Critical9.82019-08-14eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability to obtain VPN profile details, shutting down the…
CVE-2019-9884Critical9.82019-07-25eClass platform < ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page.
CVE-2019-9552Critical9.82019-03-04Eloan V3.0 through 2018-09-20 allows remote attackers to list files via a direct request to the p2p/api/ or p2p/lib/ or p2p/images/ URI.
CVE-2019-7736Critical9.82019-02-11D-Link DIR-600M C1 3.04 devices allow authentication bypass via a direct request to the wan.htm page. NOTE: this may overlap CVE-2019-13101.
CVE-2018-18922Critical9.82018-12-13add_user in AbiSoft Ticketly 1.0 allows remote attackers to create administrator accounts via an action/add_user.php POST request.
CVE-2018-19207Critical9.82018-11-12The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code because $wpdb->prep…
All CVEs classified under CWE-425 — newest first (page 1 of 3)
CVESeverityScorePublishedSummary
CVE-2026-19903Medium5.32026-08-15A vulnerability has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db/shopping.sql of the component SQL Data…
CVE-2026-60011Medium5.32026-08-03Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image data stored to the affected product.
CVE-2026-21760Medium4.62026-07-17HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthori…
CVE-2024-23573Low3.72026-07-17HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that makes the SS LLUCKY13 possible affects the TLS1.1and 1.2 and…
CVE-2026-13533Medium5.32026-06-29A security vulnerability has been detected in agentejo Cockpit CMS up to 0.12.2. Affected by this issue is the function Spyc::YAMLLoad of the file /config/conf…
CVE-2026-10521High7.22026-06-23An high privileged remote attacker can access a hidden configuration method, that should not be accessible by any user, to modify critical program parameters…
CVE-2026-9610Low2.32026-06-22IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 exposes resources or functionality that isn't linked in the UI but is acc…
CVE-2026-340282026-06-15The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, exposes web-accessible file paths that are not protected by an authorization scheme. An…
CVE-2026-11986Medium4.92026-06-11A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certai…
CVE-2026-8205Medium5.32026-05-21Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action_get_events does not check canView on the calendar which r…
CVE-2026-42297High8.32026-05-09Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, th…
CVE-2026-7500Medium5.42026-04-30When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned pa…
CVE-2024-58343Medium4.32026-04-16Vision Helpdesk before 5.7.0 (patched in 5.6.10) allows attackers to read user profiles via modified serialized cookie data to vis_client_id.
CVE-2026-35029High8.82026-04-06LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role…
CVE-2026-29909Medium5.32026-03-30MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module. The /admin/file/list.do endpoint lacks authenticati…
CVE-2025-15381High7.12026-03-27In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This…
CVE-2026-4900Medium5.32026-03-26A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file /dbfood/localhost.sql. This manipulat…
CVE-2026-34056High7.72026-03-26OpenEMR is a free and open source electronic health records and medical practice management application. A Broken Access Control vulnerability in OpenEMR up to…
CVE-2026-34051Medium5.42026-03-26OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have an improper access cont…
CVE-2026-33217High7.12026-03-25NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using ACLs on messag…
CVE-2026-4532Medium5.32026-03-22A security vulnerability has been detected in code-projects Simple Food Ordering System up to 1.0. Affected by this vulnerability is an unknown functionality o…
CVE-2026-22732Critical9.12026-03-19When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be writ…
CVE-2026-32867Medium5.42026-03-19OPEXUS eComplaint before version 10.1.0.0 allows an unauthenticated attacker to obtain or guess an existing case number and upload arbitrary files via 'Portal/…
CVE-2025-155872026-03-16Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged user to read an administrator's password by directly accessin…
CVE-2026-25679High7.52026-03-06url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
CVE-2026-1978Medium5.32026-02-06A vulnerability was detected in kalyan02 NanoCMS up to 0.4. Affected by this issue is some unknown functionality of the file /data/pagesdata.txt of the compone…
CVE-2025-52024Critical9.42026-01-23A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By ac…
CVE-2026-0790High7.52026-01-23ALGO 8180 IP Audio Alerter Web UI Direct Request Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive informa…
CVE-2026-06502026-01-07OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normal…
CVE-2025-15153Low3.72025-12-28A weakness has been identified in PbootCMS up to 3.2.12. Impacted is an unknown function of the file /data/pbootcms.db of the component SQLite Database. Execut…
CVE-2025-67844Medium5.02025-12-19The GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote attackers to obtain sensitive repository metadata via the repository owner and…
CVE-2025-650112025-12-18In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) an unauthorised user can view configuration files by directly referencing the resource in que…
CVE-2025-263812025-12-17Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information.
CVE-2025-14697Low3.72025-12-15A security flaw has been discovered in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 4.10.24.3. Affected by this issue is some unknow…
CVE-2025-57823Low2.72025-12-09A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator…
CVE-2025-6195Medium4.32025-11-26GitLab has remediated an issue in GitLab EE affecting all versions from 13.7 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed…
CVE-2025-62778Medium5.32025-10-27Frappe Learning is a learning management system. A security issue was identified in Frappe Learning 2.39.1 and earlier, where students were able to access the…
CVE-2025-11280Low3.72025-10-05A flaw has been found in Frappe LMS 2.35.0. Impacted is an unknown function of the file /files/ of the component Assignment Picture Handler. This manipulation…
CVE-2025-59797Medium5.82025-09-22Profession Fit 5.0.99 Build 44910 allows authorization bypass via a direct request for /api/challenges/{id} and also URLs for eversports, the user-management p…
CVE-2025-10287Low3.12025-09-12A vulnerability has been found in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. The affected element is an unknown function of the file /au…
CVE-2025-31971Medium5.12025-08-28AIML Solutions for HCL SX is vulnerable to a URL validation vulnerability.  The issue may allow attackers to launch a server-side request forgery (SSRF) attack…
CVE-2022-43110Critical9.82025-08-22Voltronic Power ViewPower through 1.04-21353 and PowerShield Netguard before 1.04-23292 allows a remote attacker to configure the system via an unspecified web…
CVE-2025-55736Medium6.52025-08-19flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, an arbitrary user can change his role to "admin", giving its relative privileges (e.g. delete u…
CVE-2025-41404Medium4.32025-06-26Direct request ('Forced Browsing') issue exists in iroha Board versions v0.10.12 and earlier. If this vulnerability is exploited, non-public contents may be vi…
CVE-2025-53073Medium4.22025-06-24In Sentry 25.1.0 through 25.5.1, an authenticated attacker can access a project's issue endpoint and perform unauthorized actions (such as adding a comment) wi…
CVE-2025-52920Medium6.42025-06-23Innoshop through 0.4.1 allows Insecure Direct Object Reference (IDOR) at multiple places within the frontend shop. Anyone can create a customer account and eas…
CVE-2025-6352Medium5.32025-06-20A vulnerability classified as problematic has been found in code-projects Automated Voting System 1.0. Affected is an unknown function of the file /vote.php of…
CVE-2025-48207High8.62025-05-21The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference.
CVE-2025-48205High8.62025-05-21The sr_feuser_register extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference.
CVE-2025-48202Medium5.32025-05-21The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference.
CVE-2025-48201High8.62025-05-21The ns_backup extension through 13.0.0 for TYPO3 has a Predictable Resource Location.
CVE-2025-47226Medium5.02025-05-02Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.
CVE-2025-46690Medium5.02025-04-27Ververica Platform 2.14.0 allows low-privileged users to access SQL connectors via a direct namespaces/default/formats request.
CVE-2025-27581Medium4.32025-04-24NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users who lack the InET role to access the InET module via direct req…
CVE-2025-2595Medium5.32025-04-23An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization template files or static elements by means of…
CVE-2025-32367High8.62025-04-11The Oz Forensics face recognition application before 4.0.8 late 2023 allows PII retrieval via /statistic/list Insecure Direct Object Reference. NOTE: the numbe…
CVE-2025-26689Critical9.82025-03-31Direct request ('Forced Browsing') issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If a remote attacker sends a specially crafted HTTP request…
CVE-2025-15422025-03-26Improper permission control vulnerability in the OXARI ServiceDesk application could allow an attacker using a guest access or an unprivileged account to gain…
CVE-2025-2147Medium5.32025-03-10A vulnerability was found in Beijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System 1.0. It has been classified as prob…
CVE-2024-55075Medium4.32025-01-06Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and rec…
CVE-2024-9945Medium5.32024-12-13An information-disclosure vulnerability exists in Fortra's GoAnywhere MFT application prior to version 7.7.0 that allows external access to the resources in ce…
CVE-2024-11049Low3.72024-11-10A vulnerability classified as problematic has been found in ZKTeco ZKBio Time 9.0.1. Affected is an unknown function of the file /auth_files/photo/ of the comp…
CVE-2024-45195High7.52024-09-04Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to versi…
CVE-2024-7753Medium5.32024-08-14A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code…
CVE-2024-42001High8.62024-08-12An improper authentication vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and p…
CVE-2024-33897Critical9.12024-08-06A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in an availability iss…
CVE-2024-7153Medium5.32024-07-27A vulnerability classified as problematic has been found in Netgear WN604 up to 20240719. Affected is an unknown function of the file siteSurvey.php. The manip…
CVE-2024-7080Medium5.32024-07-24A vulnerability was found in SourceCodester Insurance Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown…
CVE-2024-39868High7.62024-07-09A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected devices do not properly validate the authentication whe…
CVE-2024-39867High7.62024-07-09A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected devices do not properly validate the authentication whe…
CVE-2024-6414Medium5.32024-06-30A vulnerability classified as problematic has been found in Parsec Automation TrakSYS 11.x.x. Affected is an unknown function of the file TS/export/contentpage…
CVE-2024-6188Medium5.32024-06-20A vulnerability was found in Parsec Automation TrackSYS 11.x.x and classified as problematic. This issue affects some unknown processing of the file /TS/export…
CVE-2024-2730Medium5.32024-04-10Mautic uses predictable page indices for unpublished landing pages, their content can be accessed by unauthenticated users under public preview URLs which coul…
CVE-2023-45598Medium5.32024-03-05A CWE-425 “Direct Request ('Forced Browsing')” vulnerability in the “measure” functionality of the web application allows a remote unauthenticated attacker to…
CVE-2023-45596Medium5.32024-03-05A CWE-425 “Direct Request ('Forced Browsing')” vulnerability in the “file_configuration” functionality of the web application allows a remote unauthenticated a…
CVE-2024-0861Medium4.32024-02-22An issue has been discovered in GitLab EE affecting all versions starting from 16.4 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions…
CVE-2023-46186Medium5.32024-02-14IBM Jazz for Service Management 1.1.3.20 could allow an unauthorized user to obtain sensitive file information using forced browsing due to improper access con…
CVE-2024-24592Critical9.82024-02-06Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote attacker to arbitrarily access, create, mod…
CVE-2023-50935Medium6.52024-02-02IBM PowerSC 1.3, 2.0, and 2.1 fails to properly restrict access to a URL or resource, which may allow a remote attacker to obtain unauthorized access to applic…
CVE-2024-0456Medium4.32024-01-26An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able…
CVE-2024-0204Critical9.82024-01-22Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.
CVE-2023-44320Medium4.32023-11-14A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2D…
CVE-2023-5786Medium5.32023-10-26A vulnerability was found in GeoServer GeoWebCache up to 1.15.1. It has been declared as problematic. This vulnerability affects unknown code of the file /geos…
CVE-2023-5702Medium4.32023-10-23A vulnerability was found in Viessmann Vitogate 300 up to 2.1.3.0 and classified as problematic. Affected by this issue is some unknown functionality of the fi…
CVE-2023-45809Low2.72023-10-19Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct UR…
CVE-2023-4018Medium4.32023-09-01An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper…
CVE-2023-4544Medium4.32023-08-26A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230809. It has been rated as problematic. This issue affects some unknown processing…
CVE-2023-3426Medium4.32023-08-02The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows re…
CVE-2023-3792Medium4.32023-07-20A vulnerability was found in Beijing Netcon NS-ASG 6.3. It has been classified as problematic. This affects an unknown part of the file /admin/test_status.php…
CVE-2015-1313Medium6.52023-06-29JetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a crafted request because the required request data can be deduced b…
CVE-2023-22834Low2.72023-06-27The Contour Service was not checking that users had permission to create an analysis for a given dataset. This could allow an attacker to clutter up Compass fo…
CVE-2023-28160Medium6.52023-06-02When following a redirect to a publicly accessible web extension file, the URL may have been translated to the actual local path, leaking potentially sensitive…
CVE-2023-2524Medium6.32023-05-04A vulnerability classified as critical has been found in Control iD RHiD 23.3.19.0. This affects an unknown part of the file /v2/#/. The manipulation leads to…
CVE-2023-1699Medium4.32023-03-30Rapid7 Nexpose versions 6.6.186 and below suffer from a forced browsing vulnerability.  This vulnerability allows an attacker to manipulate URLs to forcefully…
CVE-2023-1663Medium6.52023-03-29Coverity versions prior to 2023.3.2 are vulnerable to forced browsing, which exposes authenticated resources to unauthorized actors. The root cause of this vul…
CVE-2023-1682Medium4.32023-03-29A vulnerability has been found in Xunrui CMS 4.61 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dayrui…
CVE-2022-42438High7.52023-02-08IBM Cloud Pak for Multicloud Management Monitoring 2.0 and 2.3 allows users without admin roles access to admin functions by specifying direct URL paths. IBM…
CVE-2022-47700High7.52023-01-31COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnerable to Incorrect Access Control. Imprope…
CVE-2022-4057Medium5.32023-01-02The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs.
CVE-2022-42953High7.52022-12-25Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form/DataApp?style=1 an…