CWE-425— Direct Request ('Forced Browsing')
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.— MITRE CWE catalog
255 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-425page 6 of 6
- CVE-2025-10287LOWCVSS 3.1EG 3.12025-09-12
A vulnerability has been found in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. The affected element is an unknown function of the file /auth/orderQuery. Such manipulation of the argument orderNo leads to direct request…
- CVE-2026-102583LOWCVSS 2.7EG 2.72026-09-30
A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This …
- CVE-2025-57823LOWCVSS 2.7EG 2.72025-12-09
A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow an authenticated…
- CVE-2023-45809LOWCVSS 2.7EG 2.72023-10-19
Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While au…
- CVE-2023-22834LOWCVSS 2.7EG 2.72023-06-27
The Contour Service was not checking that users had permission to create an analysis for a given dataset. This could allow an attacker to clutter up Compass folders with extraneous analyses, that the attacker would otherwise not have permi…
Map vulnerabilities like CWE-425 to your infrastructure
EchelonGraph correlates every CVE — across CWE-425 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →