CWE-425 · weakness in Access Control
Direct Request
218 CVEs · 2 exploited
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 2
- check available
- 16
- likely to be exploited
- 11
Every one of the 218 is a mark on the map. Named now: 1 to 26, most at risk first.
- Apache OFBiz - Remote Code Execution
- Atlassian Confluence Server - Local File Inclusion
- Fortra GoAnywhere MFT - Authentication Bypass
- WP GDPR Compliance < 1.4.3 - Unauthenticated Call Any Action or Update Any Option
- Kentico - Installer Privilege Escalation
- Kirona Dynamic Resource Scheduler - Information Disclosure
- Gurock TestRail Application files.md5 Exposure
- Zyxel ZyWall UAG/USG - Account Creation Access
- WordPress Duplicator <1.4.7 - Authentication Bypass
- Ametys CMS Information Disclosure
- Reprise License Manager 14.2 - Information Disclosure
- WAVLINK WN579 X3 M79X3.V5030.180719 - Information Disclosure
- TCExam <= 14.8.1 - Sensitive Information Exposure
- WordPress Ninja Job Board < 1.3.3 - Direct Request
- Hongdian H8922 3.0.5 - Information Disclosure
- TrakSYS 11.x.x - Sensitive Data Exposure
- Autoptimize < 3.1.0 - Information Disclosure
- OpenFlagr <= 1.1.18 - Authentication Bypass
- An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote configuration download vulner…
- Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a direct request for cgi-bin/DownloadCfg/Rout…
- DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an unauthenticated remote configuration download.
- LG SuperSign CMS allows TVs to be rebooted remotely without authentication via a direct HTTP request to /qsr_server/device/reboot on port 9080.
- An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in nia_munoz_monitoring_system/admin/uploads. An attacker can leverage this vulne…
- Mitsubishi Electric Europe B.V. SmartRTU devices allow remote attackers to obtain sensitive information (directory listing and source code) via a direct request to the /web URI.
- D-Link DSL-504T allows remote attackers to bypass authentication and gain privileges, such as upgrade firmware, restart the router or restore a saved configuration, via a direct r…
- Belkin Linksys Velop 1.1.8.192419 devices allows remote attackers to discover the recovery key via a direct request for the /sysinfo_json.cgi URI.
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.