CWE-425
AllowedDirect Request ('Forced Browsing')
Abstraction: Base · Status: Incomplete
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
285 vulnerabilities reference this CWE, most recent first.
GHSA-C487-M6XP-C9JC
Vulnerability from github – Published: 2025-06-23 21:31 – Updated: 2025-06-23 21:31Innoshop through 0.4.1 allows Insecure Direct Object Reference (IDOR) at multiple places within the frontend shop. Anyone can create a customer account and easily exploit these. Successful exploitation results in disclosure of the PII of other customers and the deletion of their reviews of products on the website. To be specific, an attacker could view the order details of any order by browsing to /en/account/orders/ORDER_ID or use the address and billing information of other customers by manipulating the shipping_address_id and billing_address_id parameters when making an order (this information is then reflected in the receipt). Additionally, an attacker could delete the reviews of other users by sending a DELETE request to /en/account/reviews/_REVIEW_ID.
{
"affected": [],
"aliases": [
"CVE-2025-52920"
],
"database_specific": {
"cwe_ids": [
"CWE-425"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-23T12:15:22Z",
"severity": "MODERATE"
},
"details": "Innoshop through 0.4.1 allows Insecure Direct Object Reference (IDOR) at multiple places within the frontend shop. Anyone can create a customer account and easily exploit these. Successful exploitation results in disclosure of the PII of other customers and the deletion of their reviews of products on the website. To be specific, an attacker could view the order details of any order by browsing to /en/account/orders/_ORDER_ID_ or use the address and billing information of other customers by manipulating the shipping_address_id and billing_address_id parameters when making an order (this information is then reflected in the receipt). Additionally, an attacker could delete the reviews of other users by sending a DELETE request to /en/account/reviews/_REVIEW_ID.",
"id": "GHSA-c487-m6xp-c9jc",
"modified": "2025-06-23T21:31:56Z",
"published": "2025-06-23T21:31:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52920"
},
{
"type": "WEB",
"url": "https://github.com/innocommerce/innoshop"
},
{
"type": "WEB",
"url": "https://medium.com/@The_Hiker/how-i-found-multiple-cves-in-innoshop-0-4-1-12c8f84ad87f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C4P5-RQ8V-R8C2
Vulnerability from github – Published: 2024-06-20 15:31 – Updated: 2024-06-20 15:31A vulnerability was found in Parsec Automation TrackSYS 11.x.x and classified as problematic. This issue affects some unknown processing of the file /TS/export/pagedefinition. The manipulation of the argument ID leads to direct request. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269159. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2024-6188"
],
"database_specific": {
"cwe_ids": [
"CWE-425"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-20T14:15:12Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in Parsec Automation TrackSYS 11.x.x and classified as problematic. This issue affects some unknown processing of the file /TS/export/pagedefinition. The manipulation of the argument ID leads to direct request. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269159. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-c4p5-rq8v-r8c2",
"modified": "2024-06-20T15:31:19Z",
"published": "2024-06-20T15:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6188"
},
{
"type": "WEB",
"url": "https://kiwiyumi.com/post/tracksys-export-source-code"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.269159"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.269159"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.354924"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CFCW-XXJ2-5VRW
Vulnerability from github – Published: 2026-02-06 06:30 – Updated: 2026-02-06 06:30A vulnerability was detected in kalyan02 NanoCMS up to 0.4. Affected by this issue is some unknown functionality of the file /data/pagesdata.txt of the component User Information Handler. Performing a manipulation results in direct request. It is possible to initiate the attack remotely. The exploit is now public and may be used. You should change the configuration settings.
{
"affected": [],
"aliases": [
"CVE-2026-1978"
],
"database_specific": {
"cwe_ids": [
"CWE-425"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-06T05:16:10Z",
"severity": "MODERATE"
},
"details": "A vulnerability was detected in kalyan02 NanoCMS up to 0.4. Affected by this issue is some unknown functionality of the file /data/pagesdata.txt of the component User Information Handler. Performing a manipulation results in direct request. It is possible to initiate the attack remotely. The exploit is now public and may be used. You should change the configuration settings.",
"id": "GHSA-cfcw-xxj2-5vrw",
"modified": "2026-02-06T06:30:27Z",
"published": "2026-02-06T06:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1978"
},
{
"type": "WEB",
"url": "https://github.com/kalyan02/NanoCMS"
},
{
"type": "WEB",
"url": "https://github.com/kalyan02/NanoCMS/blob/master/data/pagesdata.txt"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.344500"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.344500"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.743260"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-CG66-GRW3-W6J2
Vulnerability from github – Published: 2022-04-29 03:01 – Updated: 2025-01-16 21:30phpMyFAQ 1.4.0 allows remote attackers to access the Image Manager to upload or delete images without authorization via a direct request.
{
"affected": [],
"aliases": [
"CVE-2004-2257"
],
"database_specific": {
"cwe_ids": [
"CWE-425"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2004-12-31T05:00:00Z",
"severity": "MODERATE"
},
"details": "phpMyFAQ 1.4.0 allows remote attackers to access the Image Manager to upload or delete images without authorization via a direct request.",
"id": "GHSA-cg66-grw3-w6j2",
"modified": "2025-01-16T21:30:53Z",
"published": "2022-04-29T03:01:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-2257"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16814"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/12085"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1010795"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/8240"
},
{
"type": "WEB",
"url": "http://www.phpmyfaq.de/advisory_2004-07-27.php"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/10813"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CQ6F-PHQ5-PC66
Vulnerability from github – Published: 2022-05-24 16:48 – Updated: 2024-04-04 01:03Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service.
{
"affected": [],
"aliases": [
"CVE-2019-12583"
],
"database_specific": {
"cwe_ids": [
"CWE-425"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-06-27T14:15:00Z",
"severity": "CRITICAL"
},
"details": "Missing Access Control in the \"Free Time\" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service.",
"id": "GHSA-cq6f-phq5-pc66",
"modified": "2024-04-04T01:03:18Z",
"published": "2022-05-24T16:48:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12583"
},
{
"type": "WEB",
"url": "https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss"
},
{
"type": "WEB",
"url": "https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CRJM-JRHG-6RM3
Vulnerability from github – Published: 2022-05-24 16:50 – Updated: 2024-04-04 01:19In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads/_/originals/ directory. This is related to a configuration option in which the file collection can be non-public, but this option does not apply to the thumbnailer.
{
"affected": [],
"aliases": [
"CVE-2019-13981"
],
"database_specific": {
"cwe_ids": [
"CWE-425"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-07-19T15:15:00Z",
"severity": "MODERATE"
},
"details": "In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads/_/originals/ directory. This is related to a configuration option in which the file collection can be non-public, but this option does not apply to the thumbnailer.",
"id": "GHSA-crjm-jrhg-6rm3",
"modified": "2024-04-04T01:19:18Z",
"published": "2022-05-24T16:50:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13981"
},
{
"type": "WEB",
"url": "https://github.com/directus/api/issues/986"
},
{
"type": "WEB",
"url": "https://github.com/directus/api/issues/987"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CV6M-PGHP-XM7F
Vulnerability from github – Published: 2026-08-20 09:31 – Updated: 2026-08-20 09:31A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php.
{
"affected": [],
"aliases": [
"CVE-2026-14953"
],
"database_specific": {
"cwe_ids": [
"CWE-425"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-20T09:16:47Z",
"severity": "MODERATE"
},
"details": "A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php.",
"id": "GHSA-cv6m-pghp-xm7f",
"modified": "2026-08-20T09:31:18Z",
"published": "2026-08-20T09:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14953"
},
{
"type": "WEB",
"url": "https://www.certvde.com/en/advisories/VDE-2026-078"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-CVGC-MX2W-H3W8
Vulnerability from github – Published: 2025-05-21 18:33 – Updated: 2025-05-21 20:09The sr_feuser_register extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference. This allows attackers to read arbitrary files.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "sjbr/sr-feuser-register"
},
"ranges": [
{
"events": [
{
"introduced": "5.1.0"
},
{
"fixed": "12.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-48205"
],
"database_specific": {
"cwe_ids": [
"CWE-425",
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2025-05-21T20:09:49Z",
"nvd_published_at": "2025-05-21T16:15:32Z",
"severity": "HIGH"
},
"details": "The sr_feuser_register extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference. This allows attackers to read arbitrary files.",
"id": "GHSA-cvgc-mx2w-h3w8",
"modified": "2025-05-21T20:09:49Z",
"published": "2025-05-21T18:33:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48205"
},
{
"type": "PACKAGE",
"url": "https://codeberg.org/sjbr/sr-feuser-register"
},
{
"type": "WEB",
"url": "https://codeberg.org/sjbr/sr-feuser-register/commit/be44f61a475371c36b2035cbb523b56f5e34267d"
},
{
"type": "WEB",
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2025-008"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "The Front End User Registration extension for TYPO3 (sr_feuser_register) allows Insecure Direct Object Reference"
}
GHSA-F4GF-WV2J-P66R
Vulnerability from github – Published: 2022-06-07 00:00 – Updated: 2022-06-18 00:00An unauthenticated attacker can send a specially crafted packets to update the “notes” section of the home page of the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29.
{
"affected": [],
"aliases": [
"CVE-2022-31485"
],
"database_specific": {
"cwe_ids": [
"CWE-425"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-06T17:15:00Z",
"severity": "MODERATE"
},
"details": "An unauthenticated attacker can send a specially crafted packets to update the \u201cnotes\u201d section of the home page of the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29.",
"id": "GHSA-f4gf-wv2j-p66r",
"modified": "2022-06-18T00:00:26Z",
"published": "2022-06-07T00:00:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31485"
},
{
"type": "WEB",
"url": "https://www.corporate.carrier.com/product-security/advisories-resources"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F8XF-39W2-MRC6
Vulnerability from github – Published: 2024-01-22 18:31 – Updated: 2024-01-22 18:31Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.
{
"affected": [],
"aliases": [
"CVE-2024-0204"
],
"database_specific": {
"cwe_ids": [
"CWE-425"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-22T18:15:20Z",
"severity": "CRITICAL"
},
"details": "Authentication bypass in Fortra\u0027s GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.",
"id": "GHSA-f8xf-39w2-mrc6",
"modified": "2024-01-22T18:31:17Z",
"published": "2024-01-22T18:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0204"
},
{
"type": "WEB",
"url": "https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml"
},
{
"type": "WEB",
"url": "https://www.fortra.com/security/advisory/fi-2024-001"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/176683/GoAnywhere-MFT-Authentication-Bypass.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/176974/Fortra-GoAnywhere-MFT-Unauthenticated-Remote-Code-Execution.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files.
Mitigation
Consider using MVC based frameworks such as Struts.
CAPEC-127: Directory Indexing
An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks.
CAPEC-143: Detect Unpublicized Web Pages
An adversary searches a targeted web site for web pages that have not been publicized. In doing this, the adversary may be able to gain access to information that the targeted site did not intend to make public.
CAPEC-144: Detect Unpublicized Web Services
An adversary searches a targeted web site for web services that have not been publicized. This attack can be especially dangerous since unpublished but available services may not have adequate security controls placed upon them given that an administrator may believe they are unreachable.
CAPEC-668: Key Negotiation of Bluetooth Attack (KNOB)
An adversary can exploit a flaw in Bluetooth key negotiation allowing them to decrypt information sent between two devices communicating via Bluetooth. The adversary uses an Adversary in the Middle setup to modify packets sent between the two devices during the authentication process, specifically the entropy bits. Knowledge of the number of entropy bits will allow the attacker to easily decrypt information passing over the line of communication.
CAPEC-87: Forceful Browsing
An attacker employs forceful browsing (direct URL entry) to access portions of a website that are otherwise unreachable. Usually, a front controller or similar design pattern is employed to protect access to portions of a web application. Forceful browsing enables an attacker to access information, perform privileged operations and otherwise reach sections of the web application that have been improperly protected.