CWE-425 · Access Control
Direct Request
218CVEs
SortMost likely exploited
218 CVEs with CWE-425 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-45195In CISA KEVExploitedApache OFBiz - Remote Code ExecutionApache Software Foundation · Apache OFBiz · CVSS 9.8 · 2024-09-04 | 9.8 | 100% | 2024-09-04 |
| CVE-2021-26085In CISA KEVExploitedAtlassian Confluence Server - Local File InclusionAtlassian · Confluence Server · CVSS 5.3 · 2021-08-03 | 5.3 | 100% | 2021-08-03 |
| CVE-2024-0204CheckFortra GoAnywhere MFT - Authentication BypassFortra · GoAnywhere MFT · CVSS 9.8 · 2024-01-22 | 9.8 | 95% | 2024-01-22 |
| CVE-2018-19207CheckWP GDPR Compliance < 1.4.3 - Unauthenticated Call Any Action or Update Any OptionVan-Ons · Wp-Gdpr-Compliance · 2018-11-12 | – | 88% | 2018-11-12 |
| CVE-2017-17736CheckKentico - Installer Privilege EscalationKentico · Xperience · 2018-03-23 | – | 68% | 2018-03-23 |
| CVE-2019-17503CheckKirona Dynamic Resource Scheduler - Information DisclosureKirona · Dynamic Resource Scheduling · 2019-10-11 | – | 48% | 2019-10-11 |
| CVE-2021-40875CheckGurock TestRail Application files.md5 ExposureGurock · Testrail · 2021-09-22 | – | 47% | 2021-09-22 |
| CVE-2019-12583CheckZyxel ZyWall UAG/USG - Account Creation AccessZyxel · Uag2100 Firmware · 2019-06-27 | – | 44% | 2019-06-27 |
| CVE-2022-2551CheckWordPress Duplicator <1.4.7 - Authentication BypassAwesomemotive · Duplicator – WordPress Migration Plugin · 2022-08-22 | – | 18% | 2022-08-22 |
| CVE-2022-26159CheckAmetys CMS Information DisclosureAmetys · Ametys · 2022-02-28 | – | 13% | 2022-02-28 |
| CVE-2022-28365CheckReprise License Manager 14.2 - Information DisclosureReprisesoftware · Reprise License Manager · 2022-04-09 | – | 9.3% | 2022-04-09 |
| CVE-2022-31847CheckWAVLINK WN579 X3 M79X3.V5030.180719 - Information DisclosureWavlink · Wn579x3 Firmware · 2022-06-14 | – | 6.6% | 2022-06-14 |
| CVE-2021-20114CheckTCExam <= 14.8.1 - Sensitive Information ExposureTecnick · TCExam · 2021-07-29 | – | 6.0% | 2021-07-29 |
| CVE-2022-2544CheckWordPress Ninja Job Board < 1.3.3 - Direct RequestWpmanageninja · Ninja Job Board – Ultimate WordPress Job Board Plugin · 2022-08-22 | – | 4.6% | 2022-08-22 |
| CVE-2021-28150CheckHongdian H8922 3.0.5 - Information DisclosureHongdian · H8922 Firmware · 2021-05-06 | – | 2.7% | 2021-05-06 |
| CVE-2024-6188CheckTrakSYS 11.x.x - Sensitive Data ExposureParsec Automation · TrackSYS · CVSS 5.3 · 2024-06-20 | 5.3 | 2.0% | 2024-06-20 |
| CVE-2022-4057CheckAutoptimize < 3.1.0 - Information DisclosureOptimizingmatters · Autoptimize · CVSS 5.3 · 2023-01-02 | 5.3 | 1.5% | 2023-01-02 |
| CVE-2026-0650CheckOpenFlagr <= 1.1.18 - Authentication BypassOpenFlagr · Flagr · CVSS 9.3 · 2026-01-07 | 9.3 | 1.5% | 2026-01-07 |
| CVE-2019-14927An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote configuration download vulner…Inea · Me-Rtu Firmware · 2019-10-28 | – | 41% | 2019-10-28 |
| CVE-2020-35391Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a direct request for cgi-bin/DownloadCfg/Rout…Tenda · F3 Firmware · CVSS 9.6 · 2021-01-01 | 9.6 | 35% | 2021-01-01 |
| CVE-2021-46378DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an unauthenticated remote configuration download.Dlink · Dir-850l Firmware · 2022-03-04 | – | 32% | 2022-03-04 |
| CVE-2018-16706LG SuperSign CMS allows TVs to be rebooted remotely without authentication via a direct HTTP request to /qsr_server/device/reboot on port 9080.Lg · Supersign Cms · 2018-09-14 | – | 22% | 2018-09-14 |
| CVE-2021-42671An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in nia_munoz_monitoring_system/admin/uploads. An attacker can leverage this vulne…Engineers Online Portal Project · Engineers Online Portal · 2021-11-05 | – | 20% | 2021-11-05 |
| CVE-2018-16060Mitsubishi Electric Europe B.V. SmartRTU devices allow remote attackers to obtain sensitive information (directory listing and source code) via a direct request to the /web URI.Mitsubishielectric · Smartrtu Firmware · 2021-10-15 | – | 20% | 2021-10-15 |
| CVE-2005-1827D-Link DSL-504T allows remote attackers to bypass authentication and gain privileges, such as upgrade firmware, restart the router or restore a saved configuration, via a direct r…Dlink · Dsl-504t Firmware · 2005-06-02 | – | 20% | 2005-06-02 |
| CVE-2019-16340Belkin Linksys Velop 1.1.8.192419 devices allows remote attackers to discover the recovery key via a direct request for the /sysinfo_json.cgi URI.Linksys · Velop Whw0303 Firmware · 2019-11-21 | – | 19% | 2019-11-21 |
| CVE-2023-5702Viessmann Vitogate 300 direct requestViessmann · Vitogate 300 · CVSS 4.3 · 2023-10-23 | 4.3 | 19% | 2023-10-23 |
| CVE-2017-14244An authentication bypass vulnerability on iBall Baton ADSL2+ Home Router FW_iB-LR7011A_1.0.2 devices potentially allows attackers to directly access administrative router settings…Iball · Ib-Wra150n Firmware · 2017-09-17 | – | 17% | 2017-09-17 |
| CVE-2022-28799The TikTok application before 23.7.3 for Android allows account takeover. A crafted URL (unvalidated deeplink) can force the com.zhiliaoapp.musically WebView to load an arbitrary…Tiktok · Tiktok · 2022-05-30 | – | 15% | 2022-05-30 |
| CVE-2021-36745A vulnerability in Trend Micro ServerProtect for Storage 6.0, ServerProtect for EMC Celerra 5.8, ServerProtect for Network Appliance Filers 5.8, and ServerProtect for Microsoft Wi…Trend Micro · Trend Micro ServerProtect for Storage · 2021-09-29 | – | 9.4% | 2021-09-29 |
| CVE-2019-14347Internal/Views/addUsers.php in Schben Adive 2.0.7 allows remote unprivileged users (editor or developer) to create an administrator account via admin/user/add, as demonstrated by…Schben · Adive · 2019-08-06 | – | 9.3% | 2019-08-06 |
| CVE-2020-24765InterMind iMind Server through 3.13.65 allows remote unauthenticated attackers to read the self-diagnostic archive via a direct api/rs/monitoring/rs/api/system/dump-diagnostic-inf…Mind · Imind Server · 2020-10-20 | – | 6.8% | 2020-10-20 |
| CVE-2017-15235The File Manager (gollem) module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to bypass Horde authentication for file downloads via a crafted fn parameter that corresp…Horde · Groupware · 2017-10-11 | – | 5.5% | 2017-10-11 |
| CVE-2022-42953Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style…Zkteco · Zmm200 Firmware · CVSS 7.5 · 2022-12-25 | 7.5 | 5.2% | 2022-12-25 |
| CVE-2002-1798MidiCart PHP, PHP Plus, and PHP Maxi allows remote attackers to (1) upload arbitrary php files via a direct request to admin/upload.php or (2) access sensitive information via a d…Midicart · Midicart Php · 2005-06-28 | – | 4.6% | 2005-06-28 |
| CVE-2019-1220A security feature bypass vulnerability exists when Microsoft Browsers fail to validate the correct Security Zone of requests for specific URLs, aka 'Microsoft Browser Security Fe…Microsoft · Internet Explorer 9 · 2019-09-11 | – | 3.8% | 2019-09-11 |
| CVE-2018-3774Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.HackerOne · url-parse · 2018-08-12 | – | 3.8% | 2018-08-12 |
| CVE-2020-24203Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects World Travel Management System v1.0 allows remote unauthenticat…Projectworlds · Travel Management System · 2020-08-27 | – | 3.7% | 2020-08-27 |
| CVE-2021-3113Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSession request. For example, the attacker ca…Netsia · Seba+ · 2021-01-17 | – | 3.2% | 2021-01-17 |
| CVE-2018-18862BMC Remedy Mid-Tier 7.1.00 and 9.1.02.003 for BMC Remedy AR System has Incorrect Access Control in ITAM forms, as demonstrated by TLS%3APLR-Configuration+Details/Default+Admin+Vie…Bmc · Remedy Mid-Tier · 2019-03-17 | – | 2.9% | 2019-03-17 |
| CVE-2016-1000111Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client…Twisted · Twisted · 2020-03-11 | – | 2.8% | 2020-03-11 |
| CVE-2004-2144Baal Smart Forms before 3.2 allows remote attackers to bypass authentication and obtain system access via a direct request to regadmin.php.Baalsystems · Baal Smart Forms · 2005-07-01 | – | 2.8% | 2005-07-01 |
| CVE-2019-7736D-Link DIR-600M C1 3.04 devices allow authentication bypass via a direct request to the wan.htm page. NOTE: this may overlap CVE-2019-13101.Dlink · Dir-600m Firmware · 2019-02-11 | – | 2.7% | 2019-02-11 |
| CVE-2019-9584eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability to obtain VPN profile details, shutting down the VPN service and to d…Eq-3 · Homematic Ccu2 Firmware · 2019-08-14 | – | 2.7% | 2019-08-14 |
| CVE-2015-2873Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263,…Trendmicro · Deep Discovery Inspector · 2015-08-23 | – | 2.7% | 2015-08-23 |
| CVE-2005-1654Hosting Controller 6.1 Hotfix 1.9 and earlier allows remote attackers to register arbitrary users via a direct request to addsubsite.asp with the loginname and password parameters…Hostingcontroller · Hosting Controller · 2005-05-18 | – | 2.5% | 2005-05-18 |
| CVE-2020-24660An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normaliz…Lemonldap-Ng · Lemonldap::ng · 2020-09-14 | – | 2.5% | 2020-09-14 |
| CVE-2018-18922add_user in AbiSoft Ticketly 1.0 allows remote attackers to create administrator accounts via an action/add_user.php POST request.Abisoftgt · Ticketly · 2018-12-13 | – | 2.4% | 2018-12-13 |
| CVE-2019-12768An issue was discovered on D-Link DAP-1650 devices through v1.03b07 before 1.04B02_J65H Hot Fix. Attackers can bypass authentication via forceful browsing.Dlink · Dap-1650 Firmware · 2020-12-30 | – | 2.3% | 2020-12-30 |
| CVE-2004-2257phpMyFAQ 1.4.0 allows remote attackers to access the Image Manager to upload or delete images without authorization via a direct request.Phpmyfaq · Phpmyfaq · CVSS 5.3 · 2005-07-17 | 5.3 | 2.3% | 2005-07-17 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.