← Back
CWE-425

250 CVEs • Abstraction: Base

Direct Request ('Forced Browsing')

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

JSON object

Loading...

CVEs (250)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2005-1827
1Dlink
1Dsl 504t Firmware
Apr 16, 2026
May 26, 2005
N/A· v4
N/A· v3
7.5 HIGH· v2
D-Link DSL-504T allows remote attackers to bypass authentication and gain privileges, such as upgrade firmware, restart the router or restore a saved configuration, via a direct request to firmwarecfg.
CVE-2005-1698
1Postnuke
1Postnuke
Apr 16, 2026
May 24, 2005
N/A· v4
N/A· v3
5.0 MEDIUM· v2
PostNuke 0.750 and 0.760RC3 allows remote attackers to obtain sensitive information via a direct request to (1) theme.php or (2) Xanthia.php in the Xanthia module, (3) user.php, (4) thelang.php, (5) text.php, (6) html.ph...Show more
PostNuke 0.750 and 0.760RC3 allows remote attackers to obtain sensitive information via a direct request to (1) theme.php or (2) Xanthia.php in the Xanthia module, (3) user.php, (4) thelang.php, (5) text.php, (6) html.php, (7) menu.php, (8) finclude.php, or (9) button.php in the pnblocks directory in the Blocks module, (10) config.php in the NS-Multisites (aka Multisites) module, or (11) xmlrpc.php, which reveals the path in an error message.Show less
CVE-2005-1697
1Postnuke
1Postnuke
Apr 16, 2026
May 24, 2005
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The RSS module in PostNuke 0.750 and 0.760RC2 and RC3 allows remote attackers to obtain sensitive information via a direct request to simple_smarty.php, which reveals the path in an error message.
CVE-2005-1688
1Wordpress
1Wordpress
Apr 16, 2026
May 20, 2005
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
Wordpress 1.5 and earlier allows remote attackers to obtain sensitive information via a direct request to files in (1) wp-content/themes/, (2) wp-includes/, or (3) wp-admin/, which reveal the path in an error message.
CVE-2005-1685
1Episodex
1Episodex Guestbook
Apr 16, 2026
May 20, 2005
N/A· v4
N/A· v3
7.5 HIGH· v2
episodex guestbook allows remote attackers to bypass authentication and edit scripts via a direct request to admin.asp.
CVE-2005-1668
1Yusasp
1Web Asset Manager
Apr 16, 2026
May 18, 2005
N/A· v4
N/A· v3
7.5 HIGH· v2
YusASP Web Asset Manager 1.0 allows remote attackers to gain privileges via a direct request to assetmanager.asp.
CVE-2005-1654
1Hostingcontroller
1Hosting Controller
Apr 16, 2026
May 18, 2005
N/A· v4
N/A· v3
7.5 HIGH· v2
Hosting Controller 6.1 Hotfix 1.9 and earlier allows remote attackers to register arbitrary users via a direct request to addsubsite.asp with the loginname and password parameters set.
CVE-2004-2257
1Phpmyfaq
1Phpmyfaq
Apr 16, 2026
Dec 31, 2004
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
phpMyFAQ 1.4.0 allows remote attackers to access the Image Manager to upload or delete images without authorization via a direct request.
CVE-2004-2144
1Baalsystems
1Baal Smart Forms
Apr 16, 2026
Dec 31, 2004
N/A· v4
N/A· v3
7.5 HIGH· v2
Baal Smart Forms before 3.2 allows remote attackers to bypass authentication and obtain system access via a direct request to regadmin.php.
CVE-2002-1798
1Midicart
3Midicart Php
Midicart Php MaxiMidicart Php Plus
Apr 16, 2026
Dec 31, 2002
N/A· v4
9.1 CRITICAL· v3
6.4 MEDIUM· v2
MidiCart PHP, PHP Plus, and PHP Maxi allows remote attackers to (1) upload arbitrary php files via a direct request to admin/upload.php or (2) access sensitive information via a direct request to admin/credit_card_info.p...Show more
MidiCart PHP, PHP Plus, and PHP Maxi allows remote attackers to (1) upload arbitrary php files via a direct request to admin/upload.php or (2) access sensitive information via a direct request to admin/credit_card_info.php.Show less