CWE-749 · Access Control
Exposed Dangerous Method or Function
199CVEs
SortMost likely exploited
199 CVEs with CWE-749 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2010-0738In CISA KEVExploitedJBoss JMX/Web Console - Authentication Bypass via HTTP Verb TamperingRed Hat · JBoss · CVSS 3.7 · 2010-04-28 | 3.7 | 74% | 2010-04-28 |
| CVE-2006-1547In CISA KEVExploitedActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form w…Apache · Struts 1 · CVSS 7.5 · 2006-03-30 | 7.5 | 55% | 2006-03-30 |
| CVE-2010-1428In CISA KEVExploitedRed Hat JBoss - Web/JMX Console AccessRed Hat · JBoss · CVSS 5.9 · 2010-04-28 | 5.9 | 53% | 2010-04-28 |
| CVE-2018-19322In CISA KEVExploitedThe GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expos…GIGABYTE · Multiple Products · CVSS 7.8 · 2018-12-21 | 7.8 | 1.8% | 2018-12-21 |
| CVE-2021-34996This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this…Commvault · CommCell · CVSS 8.8 · 2022-01-13 | 8.8 | 82% | 2022-01-13 |
| CVE-2018-10931It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privil…The Cobbler Project · cobbler · CVSS 9.8 · 2018-08-09 | 9.8 | 68% | 2018-08-09 |
| CVE-2023-38124Inductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution VulnerabilityInductive Automation · Ignition · CVSS 7.2 · 2024-05-03 | 7.2 | 60% | 2024-05-03 |
| CVE-2023-51573Voltronic Power ViewPower Pro updateManagerPassword Exposed Dangerous Function Authentication Bypass VulnerabilityVoltronic Power · ViewPower Pro · CVSS 9.8 · 2024-04-01 | 9.8 | 46% | 2024-04-01 |
| CVE-2023-27363Foxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution VulnerabilityFoxit · PDF Reader · CVSS 7.8 · 2024-05-03 | 7.8 | 42% | 2024-05-03 |
| CVE-2023-49074A denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted s…Tp-Link · AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) · CVSS 7.4 · 2024-04-09 | 7.4 | 13% | 2024-04-09 |
| CVE-2020-15623This vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this…CentOS Web Panel · CentOS Web Panel · CVSS 9.8 · 2020-07-28 | 9.8 | 8.3% | 2020-07-28 |
| CVE-2020-17388This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is required to exploit…Marvell · QConvergeConsole · CVSS 8.8 · 2020-08-25 | 8.8 | 7.5% | 2020-08-25 |
| CVE-2021-42128An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 using inforail Service allows Privilege Escalation via Enterprise Server Service.Ivanti · Ivanti Avalanche · 2021-12-07 | – | 4.6% | 2021-12-07 |
| CVE-2014-5415Beckhoff Embedded PC Images and TwinCAT Components Exposed Dangerous Method or FunctionBeckhoff · Embedded PC Images · CVSS 9.1 · 2016-10-05 | 9.1 | 4.3% | 2016-10-05 |
| CVE-2023-44414D-Link D-View coreservice_action_script Exposed Dangerous Function Remote Code Execution VulnerabilityD-Link · D-View · CVSS 9.8 · 2024-05-03 | 9.8 | 2.9% | 2024-05-03 |
| CVE-2025-26651Windows Local Session Manager (LSM) Denial of Service VulnerabilityMicrosoft · Windows 11 version 22H2 · CVSS 6.5 · 2025-04-08 | 6.5 | 2.6% | 2025-04-08 |
| CVE-2021-26614IpTime C200 IP camera remote code execution vulnerabilityEFM networks & multimedia · ipTIME C200 IP Camera · CVSS 7.5 · 2021-11-22 | 7.5 | 2.5% | 2021-11-22 |
| CVE-2016-9469Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeRequest objects on a GitLab instance. For Git…Gitlab · GitLab Community Edition & GitLab Enterprise Edition 8.13.0, 8.13.0-ee, 8.13.1,… · 2017-03-28 | – | 2.4% | 2017-03-28 |
| CVE-2023-38101NETGEAR ProSAFE Network Management System SettingConfigController Exposed Dangerous Function Remote Code Execution VulnerabilityNETGEAR · ProSAFE Network Management System · CVSS 7.2 · 2024-05-03 | 7.2 | 2.1% | 2024-05-03 |
| CVE-2023-38097NETGEAR ProSAFE Network Management System BkreProcessThread Exposed Dangerous Function Remote Code Execution VulnerabilityNETGEAR · ProSAFE Network Management System · CVSS 7.2 · 2024-05-03 | 7.2 | 2.1% | 2024-05-03 |
| CVE-2014-0758ICONICS GENESIS32 Exposed Dangerous Method or FunctionICONICS · GENESIS32 · CVSS 9.3 · 2014-02-24 | 9.3 | 2.1% | 2014-02-24 |
| CVE-2019-18342A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The SFTP service (default port 22/tcp) of the Control Center Server (CCS) does not prop…Siemens · Control Center Server (CCS) · CVSS 9.9 · 2019-12-12 | 9.9 | 2.1% | 2019-12-12 |
| CVE-2016-7462The Suite REST API in VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to write arbitrary content to files or rename files via a crafted D…Vmware · Vrealize Operations · 2016-12-29 | – | 2.0% | 2016-12-29 |
| CVE-2019-4386IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 could allow an authenticated user to execute a function that would cause the server to crash. IBM X-Force ID…IBM · DB2 for Linux, UNIX and Windows · CVSS 6.5 · 2019-07-01 | 6.5 | 2.0% | 2019-07-01 |
| CVE-2019-10918A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All vers…Siemens AG · SIMATIC PCS 7 V8.0 and earlier · 2019-05-14 | – | 1.9% | 2019-05-14 |
| CVE-2023-39468Triangle MicroWorks SCADA Data Gateway DbasSectorFileToExecuteOnReset Exposed Dangerous Function Remote Code Execution VulnerabilityTriangle MicroWorks · SCADA Data Gateway · CVSS 7.2 · 2024-05-03 | 7.2 | 1.9% | 2024-05-03 |
| CVE-2023-40501LG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution VulnerabilityLG · Simple Editor · CVSS 9.8 · 2024-05-03 | 9.8 | 1.9% | 2024-05-03 |
| CVE-2023-40500LG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution VulnerabilityLG · Simple Editor · CVSS 9.8 · 2024-05-03 | 9.8 | 1.9% | 2024-05-03 |
| CVE-2024-5298D-Link D-View queryDeviceCustomMonitorResult Exposed Dangerous Method Remote Code Execution VulnerabilityD-Link · D-View · CVSS 8.8 · 2024-05-23 | 8.8 | 1.8% | 2024-05-23 |
| CVE-2024-5299D-Link D-View execMonitorScript Exposed Dangerous Method Remote Code Execution VulnerabilityD-Link · D-View · CVSS 8.8 · 2024-05-23 | 8.8 | 1.8% | 2024-05-23 |
| CVE-2023-39470PaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution VulnerabilityPaperCut · NG · CVSS 7.2 · 2024-11-22 | 7.2 | 1.8% | 2024-11-22 |
| CVE-2019-12948A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an a…Polycom · Unified Communications Software · 2019-07-29 | – | 1.7% | 2019-07-29 |
| CVE-2020-8212Improper access control in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before…Citrix · Citrix XenMobile Server · 2020-08-17 | – | 1.6% | 2020-08-17 |
| CVE-2023-51574Voltronic Power ViewPower updateManagerPassword Exposed Dangerous Method Authentication Bypass VulnerabilityVoltronic Power · ViewPower · CVSS 9.8 · 2024-05-03 | 9.8 | 1.6% | 2024-05-03 |
| CVE-2023-51583Voltronic Power ViewPower UpsScheduler Exposed Dangerous Method Remote Code Execution VulnerabilityVoltronic Power · ViewPower · CVSS 9.8 · 2024-05-03 | 9.8 | 1.5% | 2024-05-03 |
| CVE-2023-51582Voltronic Power ViewPower LinuxMonitorConsole Exposed Dangerous Method Remote Code Execution VulnerabilityVoltronic Power · ViewPower · CVSS 9.8 · 2024-05-03 | 9.8 | 1.5% | 2024-05-03 |
| CVE-2023-51581Voltronic Power ViewPower MacMonitorConsole Exposed Dangerous Method Remote Code Execution VulnerabilityVoltronic Power · ViewPower · CVSS 9.8 · 2024-05-03 | 9.8 | 1.5% | 2024-05-03 |
| CVE-2023-51575Voltronic Power ViewPower MonitorConsole Exposed Dangerous Method Remote Code Execution VulnerabilityVoltronic Power · ViewPower · CVSS 9.8 · 2024-05-03 | 9.8 | 1.5% | 2024-05-03 |
| CVE-2026-54753Nx: `nx graph` dev server permissive CORS policynrwl · nx · CVSS 5.9 · 2026-06-26 | 5.9 | 1.4% | 2026-06-26 |
| CVE-2023-50422Escalation of Privileges in SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library)SAP_SE · cloud-security-services-integration-library · CVSS 9.1 · 2023-12-12 | 9.1 | 1.4% | 2023-12-12 |
| CVE-2020-12928A vulnerability in a dynamically loaded AMD driver in AMD Ryzen Master V15 may allow any authenticated user to escalate privileges to NT authority system.Amd · AMD Ryzen Master · 2020-10-13 | – | 1.3% | 2020-10-13 |
| CVE-2026-30957OneUptime Synthetic Monitor RCE via exposed Playwright browser objectOneUptime · oneuptime · CVSS 10 · 2026-03-10 | 10.0 | 1.3% | 2026-03-10 |
| CVE-2023-51578Voltronic Power ViewPower MonitorConsole Exposed Dangerous Method Denial-of-Service VulnerabilityVoltronic Power · ViewPower · CVSS 7.5 · 2024-05-03 | 7.5 | 1.3% | 2024-05-03 |
| CVE-2019-20923Crash while handling internal Javascript exception typesMongoDB Inc. · MongoDB Server · CVSS 6.5 · 2020-11-23 | 6.5 | 1.3% | 2020-11-23 |
| CVE-2023-40150Softneta MedDream PACS Exposed Dangerous Method or FunctionSoftneta · MedDream PACS · CVSS 9.8 · 2023-09-11 | 9.8 | 1.3% | 2023-09-11 |
| CVE-2023-42032Visualware MyConnection Server doRTAAccessUPass Exposed Dangerous Method Information Disclosure VulnerabilityVisualware · MyConnection Server · CVSS 7.5 · 2024-05-03 | 7.5 | 1.2% | 2024-05-03 |
| CVE-2025-9611Microsoft Playwright MCP Server < 0.0.40 DNS Rebinding via Missing Origin Header ValidationMicrosoft · Playwright · CVSS 7.2 · 2026-01-07 | 7.2 | 1.2% | 2026-01-07 |
| CVE-2023-3656Unauthenticated Remote Code ExecutionPoS/ Dienstleistung, Entwicklung & Vertrieb GmbH · cashIT! - serving solutions. · CVSS 9.8 · 2023-10-03 | 9.8 | 1.2% | 2023-10-03 |
| CVE-2023-39226Delta Electronics InfraSuite Device Master Exposed Dangerous Method Or FunctionDelta Electronics · InfraSuite Device Master · CVSS 9.8 · 2023-11-30 | 9.8 | 1.2% | 2023-11-30 |
| CVE-2023-40151Red Lion Controls Sixnet RTU Exposed Dangerous Method Or FunctionRed Lion Controls · ST-IPm-8460 · CVSS 10 · 2023-11-21 | 10.0 | 1.1% | 2023-11-21 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.