CWE-425
AllowedDirect Request ('Forced Browsing')
Abstraction: Base · Status: Incomplete
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
269 vulnerabilities reference this CWE, most recent first.
GHSA-5937-P7HV-J7MH
Vulnerability from github – Published: 2025-04-23 09:33 – Updated: 2025-04-23 09:33An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization template files or static elements by means of forced browsing.
{
"affected": [],
"aliases": [
"CVE-2025-2595"
],
"database_specific": {
"cwe_ids": [
"CWE-425"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-23T08:15:14Z",
"severity": "MODERATE"
},
"details": "An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization template files or static elements by means of forced browsing.",
"id": "GHSA-5937-p7hv-j7mh",
"modified": "2025-04-23T09:33:32Z",
"published": "2025-04-23T09:33:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2595"
},
{
"type": "WEB",
"url": "https://certvde.com/en/advisories/VDE-2025-027"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-597G-QJQV-F858
Vulnerability from github – Published: 2026-03-27 00:31 – Updated: 2026-03-27 00:31A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file /dbfood/localhost.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. It is advisable to modify the configuration settings.
{
"affected": [],
"aliases": [
"CVE-2026-4900"
],
"database_specific": {
"cwe_ids": [
"CWE-425"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-26T22:16:32Z",
"severity": "MODERATE"
},
"details": "A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file /dbfood/localhost.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. It is advisable to modify the configuration settings.",
"id": "GHSA-597g-qjqv-f858",
"modified": "2026-03-27T00:31:21Z",
"published": "2026-03-27T00:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4900"
},
{
"type": "WEB",
"url": "https://code-projects.org"
},
{
"type": "WEB",
"url": "https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Online%20Food%20Ordering%20System%20in%20PHP%201.0%20%E2%80%93%20Sensitive%20Information%20Disclosure.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.353642"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.353642"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.776980"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-5CH4-C735-4F8X
Vulnerability from github – Published: 2022-05-24 17:02 – Updated: 2024-03-21 03:33PEGA Platform 7.x and 8.x is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyActivity=GetWebInfo&target=popup&pzHarnessID=random_harness_id request to get database schema information while using a low-privilege account.
{
"affected": [],
"aliases": [
"CVE-2019-16386"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-425"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-11-26T18:15:00Z",
"severity": "MODERATE"
},
"details": "PEGA Platform 7.x and 8.x is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyActivity=GetWebInfo\u0026target=popup\u0026pzHarnessID=random_harness_id request to get database schema information while using a low-privilege account.",
"id": "GHSA-5ch4-c735-4f8x",
"modified": "2024-03-21T03:33:47Z",
"published": "2022-05-24T17:02:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16386"
},
{
"type": "WEB",
"url": "https://blog.cybercastrum.com/2019/11/25/cve-2019-16386"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5J7H-6H58-QC57
Vulnerability from github – Published: 2023-01-31 18:30 – Updated: 2023-02-08 03:30COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnerable to Incorrect Access Control. Improper authentication allows requests to be made to back-end scripts without a valid session or authentication.
{
"affected": [],
"aliases": [
"CVE-2022-47700"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-425"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-31T18:15:00Z",
"severity": "HIGH"
},
"details": "COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnerable to Incorrect Access Control. Improper authentication allows requests to be made to back-end scripts without a valid session or authentication.",
"id": "GHSA-5j7h-6h58-qc57",
"modified": "2023-02-08T03:30:24Z",
"published": "2023-01-31T18:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47700"
},
{
"type": "WEB",
"url": "https://github.com/OlivierLaflamme/cve/blob/main/COMFAST/CF-WR623N/auth_bypass"
},
{
"type": "WEB",
"url": "https://github.com/OlivierLaflamme/cve/blob/main/COMFAST/CF-WR623N/auth_bypass.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5QVC-CHCX-P36X
Vulnerability from github – Published: 2023-05-04 21:30 – Updated: 2023-05-04 21:30A vulnerability classified as critical has been found in Control iD RHiD 23.3.19.0. This affects an unknown part of the file /v2/#/. The manipulation leads to direct request. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-228015. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2023-2524"
],
"database_specific": {
"cwe_ids": [
"CWE-425"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-04T19:15:09Z",
"severity": "MODERATE"
},
"details": "A vulnerability classified as critical has been found in Control iD RHiD 23.3.19.0. This affects an unknown part of the file /v2/#/. The manipulation leads to direct request. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-228015. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-5qvc-chcx-p36x",
"modified": "2023-05-04T21:30:27Z",
"published": "2023-05-04T21:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2524"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.228015"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.228015"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-5RRM-4J7M-Q4W8
Vulnerability from github – Published: 2022-05-24 17:17 – Updated: 2023-06-19 18:30In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops Manager instance.
{
"affected": [],
"aliases": [
"CVE-2019-2388"
],
"database_specific": {
"cwe_ids": [
"CWE-425"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-05-13T17:15:00Z",
"severity": "MODERATE"
},
"details": "In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops Manager instance.",
"id": "GHSA-5rrm-4j7m-q4w8",
"modified": "2023-06-19T18:30:47Z",
"published": "2022-05-24T17:17:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2388"
},
{
"type": "WEB",
"url": "https://docs.opsmanager.mongodb.com/current/release-notes/application/#onprem-server-4-0"
},
{
"type": "WEB",
"url": "https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-4.0.11"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5WRQ-C7C8-H4HX
Vulnerability from github – Published: 2022-05-24 17:47 – Updated: 2022-07-31 00:00An Improper Access Control vulnerability was discovered in the Controlled Admin Access WordPress plugin before 1.5.2. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromise of the target resource.
{
"affected": [],
"aliases": [
"CVE-2021-24215"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-425"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-12T14:15:00Z",
"severity": "CRITICAL"
},
"details": "An Improper Access Control vulnerability was discovered in the Controlled Admin Access WordPress plugin before 1.5.2. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromise of the target resource.",
"id": "GHSA-5wrq-c7c8-h4hx",
"modified": "2022-07-31T00:00:58Z",
"published": "2022-05-24T17:47:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24215"
},
{
"type": "WEB",
"url": "https://m0ze.ru/vulnerability/[2021-03-18]-[WordPress]-[CWE-284]-Controlled-Admin-Access-WordPress-Plugin-v1.4.0.txt"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/eec0f29f-a985-4285-8eed-d1855d204a20"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6565-R3QG-5289
Vulnerability from github – Published: 2025-04-24 00:31 – Updated: 2025-04-24 00:31NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users who lack the InET role to access the InET module via direct requests to known endpoints.
{
"affected": [],
"aliases": [
"CVE-2025-27581"
],
"database_specific": {
"cwe_ids": [
"CWE-425"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-24T00:15:16Z",
"severity": "MODERATE"
},
"details": "NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users who lack the InET role to access the InET module via direct requests to known endpoints.",
"id": "GHSA-6565-r3qg-5289",
"modified": "2025-04-24T00:31:19Z",
"published": "2025-04-24T00:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27581"
},
{
"type": "WEB",
"url": "https://brics.cit.nih.gov"
},
{
"type": "WEB",
"url": "https://github.com/RoseHacks/Vulnerability.Research/blob/main/CVE-2025-27581/README.md"
},
{
"type": "WEB",
"url": "https://github.com/brics-dev/brics"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-65XM-FP9J-M223
Vulnerability from github – Published: 2022-11-15 12:00 – Updated: 2025-05-13 21:30The Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576) is affected by a password exposure vulnerability. When combined with the improper authorization/improper session management vulnerability, an attacker with access to the router may be able to expose sensitive information which they're not explicitly authorized to have.
{
"affected": [],
"aliases": [
"CVE-2022-40845"
],
"database_specific": {
"cwe_ids": [
"CWE-425",
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-15T02:15:00Z",
"severity": "MODERATE"
},
"details": "The Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576) is affected by a password exposure vulnerability. When combined with the improper authorization/improper session management vulnerability, an attacker with access to the router may be able to expose sensitive information which they\u0027re not explicitly authorized to have.",
"id": "GHSA-65xm-fp9j-m223",
"modified": "2025-05-13T21:30:27Z",
"published": "2022-11-15T12:00:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40845"
},
{
"type": "WEB",
"url": "https://boschko.ca/tenda_ac1200_router"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-68H7-48RV-WGW5
Vulnerability from github – Published: 2022-05-13 01:41 – Updated: 2022-05-13 01:41"Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows remote attackers to bypass access restriction to view information or modify configurations via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2017-10833"
],
"database_specific": {
"cwe_ids": [
"CWE-425"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-08-29T01:35:00Z",
"severity": "CRITICAL"
},
"details": "\"Dokodemo eye Smart HD\" SCR02HD Firmware 1.0.3.1000 and earlier allows remote attackers to bypass access restriction to view information or modify configurations via unspecified vectors.",
"id": "GHSA-68h7-48rv-wgw5",
"modified": "2022-05-13T01:41:58Z",
"published": "2022-05-13T01:41:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10833"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN87410770/index.html"
},
{
"type": "WEB",
"url": "http://www.nippon-antenna.co.jp/product/ine/pdf/scr02hd_about_security.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files.
Mitigation
Consider using MVC based frameworks such as Struts.
CAPEC-127: Directory Indexing
An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks.
CAPEC-143: Detect Unpublicized Web Pages
An adversary searches a targeted web site for web pages that have not been publicized. In doing this, the adversary may be able to gain access to information that the targeted site did not intend to make public.
CAPEC-144: Detect Unpublicized Web Services
An adversary searches a targeted web site for web services that have not been publicized. This attack can be especially dangerous since unpublished but available services may not have adequate security controls placed upon them given that an administrator may believe they are unreachable.
CAPEC-668: Key Negotiation of Bluetooth Attack (KNOB)
An adversary can exploit a flaw in Bluetooth key negotiation allowing them to decrypt information sent between two devices communicating via Bluetooth. The adversary uses an Adversary in the Middle setup to modify packets sent between the two devices during the authentication process, specifically the entropy bits. Knowledge of the number of entropy bits will allow the attacker to easily decrypt information passing over the line of communication.
CAPEC-87: Forceful Browsing
An attacker employs forceful browsing (direct URL entry) to access portions of a website that are otherwise unreachable. Usually, a front controller or similar design pattern is employed to protect access to portions of a web application. Forceful browsing enables an attacker to access information, perform privileged operations and otherwise reach sections of the web application that have been improperly protected.