← Back
CWE-425

240 CVEs • Abstraction: Base

Direct Request ('Forced Browsing')

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

JSON object

Loading...

CVEs (240)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
1Dlink
1Dap 1650 Firmware
Jun 17, 2026
Dec 30, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
An issue was discovered on D-Link DAP-1650 devices through v1.03b07 before 1.04B02_J65H Hot Fix. Attackers can bypass authentication via forceful browsing.
1Nchsoftware
1Express Accounts
Jun 17, 2026
Dec 28, 2020
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
In NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as Add/Edit users.
1Schneider Electric
20140cpu65150 Firmware
140noc77101 Firmware140noc78000 Firmware+17 more
Jun 17, 2026
Dec 11, 2020
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
A CWE-425: Direct Request ('Forced Browsing') vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for...Show more
A CWE-425: Direct Request ('Forced Browsing') vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions), that could cause disclosure of sensitive data when sending a specially crafted request to the controller over HTTP.Show less
1Asus
1Rt Ac88u Firmware
Jun 17, 2026
Dec 9, 2020
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
An information disclosure vulnerability exists in RT-AC88U Download Master before 3.1.0.108. A direct access to /downloadmaster/dm_apply.cgi?action_mode=initial&download_type=General&special_cgi=get_language makes it pos...Show more
An information disclosure vulnerability exists in RT-AC88U Download Master before 3.1.0.108. A direct access to /downloadmaster/dm_apply.cgi?action_mode=initial&download_type=General&special_cgi=get_language makes it possible to reach "unknown functionality" in a "known to be easy" manner via an unspecified "public exploit."Show less
1Openclinic Project
1Openclinic
Jun 17, 2026
Dec 3, 2020
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
OpenClinic version 0.8.2 is affected by a missing authentication vulnerability that allows unauthenticated users to access any patient's medical test results, possibly resulting in disclosure of Protected Health Informat...Show more
OpenClinic version 0.8.2 is affected by a missing authentication vulnerability that allows unauthenticated users to access any patient's medical test results, possibly resulting in disclosure of Protected Health Information (PHI) stored in the application, via a direct request for the /tests/ URI.Show less
1Mind
1Imind Server
Jun 17, 2026
Oct 20, 2020
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
InterMind iMind Server through 3.13.65 allows remote unauthenticated attackers to read the self-diagnostic archive via a direct api/rs/monitoring/rs/api/system/dump-diagnostic-info?server=127.0.0.1 request.
1Logaritmo
1Aware Callmanager
Jun 17, 2026
Sep 30, 2020
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
info.php in Logaritmo Aware CallManager 2012 allows remote attackers to obtain sensitive information via a direct request, which calls the phpinfo function.
2Debian
Lemonldap Ng
2Debian Linux
Lemonldap\
Jun 17, 2026
Sep 14, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before...Show more
An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the "Lemonldap::NG handler for Node.js" package.Show less
1Projectworlds
1Travel Management System
Jun 17, 2026
Aug 27, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects World Travel Management System v1.0 allows remote unauthenticated attackers to gain remote code executio...Show more
Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects World Travel Management System v1.0 allows remote unauthenticated attackers to gain remote code execution.Show less
1Pandorafms
1Pandora Fms
Jun 17, 2026
Jun 11, 2020
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Artica Pandora FMS 7.44 has inadequate access controls on a web folder.
1Mongodb
1Ops Manager
Jun 17, 2026
May 13, 2020
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops Manager instance. This issue affects: MongoDB Inc. MongoDB Ops Manager...Show more
In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops Manager instance. This issue affects: MongoDB Inc. MongoDB Ops Manager 4.0 versions 4.0.9, 4.0.10 and MongoDB Ops Manager 4.1 version 4.1.5.Show less
1Nchsoftware
1Express Invoice
Jun 17, 2026
Apr 7, 2020
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
In NCH Express Invoice 7.25, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as the "Add New Item" screen.
1Twisted
1Twisted
Nov 25, 2024
Mar 11, 2020
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment varia...Show more
Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.Show less
1Meinbwa
1Direx Pro Firmware
Jun 17, 2026
Mar 9, 2020
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
BWA DiREX-Pro 1.2181 devices allow remote attackers to discover passwords via a direct request to val_users.php3.
1Monstra
1Monstra
Jun 17, 2026
Mar 7, 2020
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
Monstra CMS through 3.0.4 allows remote authenticated users to take over arbitrary user accounts via a modified login parameter to an edit URI, as demonstrated by login=victim to the users/21/edit URI.
1Centreon
1Centreon
Jun 17, 2026
Mar 5, 2020
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
An issue was discovered in Centreon before 18.10.8, 19.04.5, and 19.10.2. It provides sensitive information via an unauthenticated direct request for api/external.php?object=centreon_metric&action=listByService.
1Centreon
1Centreon
Jun 17, 2026
Mar 5, 2020
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
An issue was discovered in Centreon before 2.8.31, 18.10.9, 19.04.6, and 19.10.3. It provides sensitive information via an unauthenticated direct request for include/configuration/configObject/service/refreshMacroAjax.ph...Show more
An issue was discovered in Centreon before 2.8.31, 18.10.9, 19.04.6, and 19.10.3. It provides sensitive information via an unauthenticated direct request for include/configuration/configObject/service/refreshMacroAjax.php.Show less
1Centreon
1Centreon
Jun 17, 2026
Mar 4, 2020
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
An issue was discovered in Centreon before 2.8-30, 18.10-8, 19.04-5, and 19.10-2.. It provides sensitive information via an unauthenticated direct request for include/configuration/configObject/host/refreshMacroAjax.php.
1Centreon
1Centreon
Jun 17, 2026
Mar 4, 2020
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
An issue was discovered in Centreon before 2.8-30,18.10-8, 19.04-5, and 19.10-2. It provides sensitive information via an unauthenticated direct request for include/monitoring/recurrentDowntime/GetXMLHost4Services.php.
1Pega
1Pega Platform
Jun 17, 2026
Nov 26, 2019
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
PEGA Platform 8.3.0 is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyStream=MyAlerts request to get Audit Log information while using a low-privilege account. NOTE: The vendor state...Show more
PEGA Platform 8.3.0 is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyStream=MyAlerts request to get Audit Log information while using a low-privilege account. NOTE: The vendor states that this vulnerability was discovered using an administrator account and they are normal administrator functions. Therefore, the claim that the CVE was done with a low privilege account is incorrectShow less