Direct Request
CWE-425
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
We track 54 vulnerabilities of this type. 98% are rated high or critical, and the average CVSS score is 8.2. 2 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design Operation: Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files.
- Architecture and Design: Consider using MVC based frameworks such as Struts.
Latest Direct Request vulnerabilities
- 8.8 High severity
Apache OFBiz: Direct Request
Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a stock non-administrative account to execute ar
- 7.5 High severity
Apache OFBiz: Direct Request
Missing check for ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to update orders. Affected versions before : 24.09.08 Users are recommended to upgrade to version 24.09.08 which fixes this issue.
- 7.5 High severity
Apache OFBiz: Direct Request
Missing check for ACCOUNTING_UPDATE / ACCOUNTING_CREATE in accounting in allows user with only ACCOUNTING_VIEW permission to update/create PaymentApplication. Affected versions before : 24.09.08 Users are recommended to upgrade to version 24.09.08 which fixes
- 9.1 Critical severity
Red Hat build of Quarkus 3.27.6.redhat: Direct Request
A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring secu
- 8.8 High severity
1456B Multi-User Gateway: Direct Request
Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to overwrite the installer
- 7.2 High severity
mbCONNECT24: Direct Request
An high privileged remote attacker can access a hidden configuration method, that should not be accessible by any user, to modify critical program parameters. This can result in a total loss of confidentiality, integrity and availability.
- 8.3 High severity
argo-workflows: Missing Authorization
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) performs zero authorization check
- 8.8 High severity
litellm: Incorrect Authorization
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to mo
- 7.1 High severity
mlflow/mlflow: Exposure of Sensitive Information to an Unauthorized Actor
In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with `NO_PERMISSIONS` on the experiment, to read trac
- 7.5 High severity
Simple Food Ordering System: Direct Request
A security vulnerability has been detected in code-projects Simple Food Ordering System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /food/sql/food.sql of the component Database Backup Handler. The manipulation leads to fil
- 9.1 Critical severity
Spring Security: Direct Request
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Hea
- 9.8 Critical severity
eComplaint: Direct Request
OPEXUS eComplaint before version 10.1.0.0 allows an unauthenticated attacker to obtain or guess an existing case number and upload arbitrary files via 'Portal/EEOC/DocumentUploadPub.aspx'. Users would see these unexpected files in cases. Uploading a large numb
- 8.6 High severity
Lan Kontroler v3.5: Direct Request
Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged user to read an administrator's password by directly accessing a specific resource inaccessible via a graphical interface. This issue has been fixed in firmware v
- 7.5 High severity
NanoCMS: Direct Request
A vulnerability was detected in kalyan02 NanoCMS up to 0.4. Affected by this issue is some unknown functionality of the file /data/pagesdata.txt of the component User Information Handler. Performing a manipulation results in direct request. It is possible to i
- 9.4 Critical severity
Gemscms Backend: Missing Authentication for Critical Functionality
A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By accessing specific URLs, an attacker is presented with a directory-style index listing all available ba
- 7.5 High severity
8180 IP Audio Alerter: Direct Request
ALGO 8180 IP Audio Alerter Web UI Direct Request Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required
- 9.3 Critical severity
Flagr: Missing Authentication for Critical Functionality
OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normalization in the whitelist logic, crafted requests can bypass authentication and access protected API e
- 7.1 High severity
WD-R608U: Direct Request
In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) an unauthorised user can view configuration files by directly referencing the resource in question. The vendor was notified early about this vulnerability, but didn't respond with the details of
- 9.1 Critical severity
Automated Voting System: Direct Request
A vulnerability classified as problematic has been found in code-projects Automated Voting System 1.0. Affected is an unknown function of the file /vote.php of the component Backend. The manipulation leads to direct request. It is possible to launch the attack
- 8.6 High severity
face recognition application: Direct Request
The Oz Forensics face recognition application before 4.0.8 late 2023 allows PII retrieval via /statistic/list Insecure Direct Object Reference. NOTE: the number 4.0.8 was used for both the unpatched and patched versions.
- 9.8 Critical severity
CHOCO TEI WATCHER mini (IB-MCT001): Direct Request
Direct request ('Forced Browsing') issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If a remote attacker sends a specially crafted HTTP request to the product, the product data may be obtained or deleted, and/or the product settings may be alte
- 9.3 Critical severity
OXARI ServiceDesk: Direct Request
Improper permission control vulnerability in the OXARI ServiceDesk application could allow an attacker using a guest access or an unprivileged account to gain additional administrative permissions in the application.This issue affects OXARI ServiceDesk in vers
- 7.5 High severity
Modern Farm Digital Integrated Management System: Direct Request
A vulnerability was found in Beijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to files or directories accessible.
- 7.5 High severity
Apache OFBiz Forced Browsing Exploited
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.
- 7.5 High severity
Clinics Patient Management System: Direct Request
A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /user_images/. The manipulation leads to direct request. The attack can be initiated rem
- 9.8 Critical severity
VAR1200-H: Direct Request
An improper authentication vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior enables an unauthenticated remote attacker to bypass authentication via a specially crafted direct request
- 9.1 Critical severity
ewon_cosy_firmware: Direct Request
A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in an availability issue. The issue was patched on the Talk2m production server on April 18, 2024.
- 7.5 High severity
Insurance Management System: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was found in SourceCodester Insurance Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /E-Insurance/. The manipulation leads to direct request. The attack can be
- 7.3 High severity
SINEMA Remote Connect Server: Direct Request
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected devices do not properly validate the authentication when performing certain actions in the web interface allowing an unauthenticated attacker to access and
- 7.3 High severity
SINEMA Remote Connect Server: Direct Request
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected devices do not properly validate the authentication when performing certain actions in the web interface allowing an unauthenticated attacker to access and
- 7.5 High severity
Jazz for Service Management: Direct Request
IBM Jazz for Service Management 1.1.3.20 could allow an unauthorized user to obtain sensitive file information using forced browsing due to improper access controls. IBM X-Force ID: 269929.
- 9.8 Critical severity
ClearML: Improper Authentication
Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote attacker to arbitrarily access, create, modify and delete files.
- 8.8 High severity
GeoWebCache: Direct Request
A vulnerability was found in GeoServer GeoWebCache up to 1.15.1. It has been declared as problematic. This vulnerability affects unknown code of the file /geoserver/gwc/rest.html. The manipulation leads to direct request. The attack can be initiated remotely.
- 9.8 Critical severity
RHiD: Direct Request
A vulnerability classified as critical has been found in Control iD RHiD 23.3.19.0. This affects an unknown part of the file /v2/#/. The manipulation leads to direct request. It is possible to initiate the attack remotely. The associated identifier of this vul
- 9.8 Critical severity
Nexpose: Direct Request
Rapid7 Nexpose versions 6.6.186 and below suffer from a forced browsing vulnerability. This vulnerability allows an attacker to manipulate URLs to forcefully browse to and access administrative pages. This vulnerability is fixed in version 6.6.187.
- 7.5 High severity
CMS: Direct Request
A vulnerability has been found in Xunrui CMS 4.61 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dayrui/My/Config/Install.txt. The manipulation leads to direct request. The attack can be launched remotely
- 8.8 High severity
Cloud Pak for Multicloud Management Monitoring: Direct Request
IBM Cloud Pak for Multicloud Management Monitoring 2.0 and 2.3 allows users without admin roles access to admin functions by specifying direct URL paths. IBM X-Force ID: 238210.
- 7.5 High severity
Cf-wr623n Firmware: Direct Request
COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnerable to Incorrect Access Control. Improper authentication allows requests to be made to back-end scripts without a valid session or authentica
- 7.5 High severity
Zmm200 Firmware: Direct Request
Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style=0 URLs. The affected versions may be before 8.88 (ZEM500-510-560-760, ZEM600-800
- 9.1 Critical severity
Trend Micro Apex One: Direct Request
A forced browsing vulnerability in Trend Micro Apex One could allow an attacker with access to the Apex One console on affected installations to escalate privileges and modify certain agent groupings. Please note: an attacker must first obtain the ability to l