CWE-749— Exposed Dangerous Method or Function
The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.— MITRE CWE catalog
229 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-749page 3 of 5
- CVE-2024-47005HIGHCVSS 8.1EG 8.12024-10-25
Sharp and Toshiba Tec MFPs provide configuration related APIs. They are expected to be called by administrative users only, but insufficiently restricted. A non-administrative user may execute some configuration APIs.
- CVE-2023-39214HIGHCVSS 8.1EG 8.12023-08-08
Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via network access.
- CVE-2023-27363HIGHCVSS 7.8EG 8.12024-05-03
Foxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required t…
- CVE-2026-109556HIGHCVSS 8.0EG 8.02026-10-12
EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable. Attackers with script execution in …
- CVE-2025-52903HIGHCVSS 8.0EG 8.02025-06-26
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions on the 2.x branch prior to 2.33.10, the Command Execution feature of File Browse…
- CVE-2025-5748HIGHCVSS 8.0EG 8.02025-06-06
WOLFBOX Level 2 EV Charger LAN OTA Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of WOLFBOX Level 2 EV Charger. Althou…
- CVE-2024-55924HIGHCVSS 8.0EG 8.02025-01-14
TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forge…
- CVE-2026-118602HIGHCVSS 7.8EG 7.82026-10-28
Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Alpine iLX-F511. An attacker must first obtain the …
- CVE-2026-113775HIGHCVSS 7.8EG 7.82026-10-27
A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk Fusion API, can trigger an Exposed Dangerous Function vulnerability in the Autodesk Fusion desktop a…
- CVE-2026-18263HIGHCVSS 7.8EG 7.82026-08-20
Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker m…
- CVE-2026-18262HIGHCVSS 7.8EG 7.82026-08-20
Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker m…
- CVE-2026-13121HIGHCVSS 7.8EG 7.82026-08-20
Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker m…
- CVE-2026-8108HIGHCVSS 7.8EG 7.82026-05-12
The installation of Fuji Tellus adds a driver to the kernel which grants all users read and write permissions.
- CVE-2026-25266HIGHCVSS 7.8EG 7.82026-05-04
Memory corruption while processing IOCTL command when device is in power-save state.
- CVE-2026-3483HIGHCVSS 7.8EG 7.82026-03-10
An exposed dangerous method in Ivanti DSM before version 2026.1.1 allows a local authenticated attacker to escalate their privileges.
- CVE-2026-20423HIGHCVSS 7.8EG 7.82026-03-02
In wlan STA driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: W…
- CVE-2025-47366HIGHCVSS 7.8EG 7.82026-02-02
Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.
- CVE-2025-14497HIGHCVSS 7.8EG 7.82025-12-23
RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must …
- CVE-2025-14496HIGHCVSS 7.8EG 7.82025-12-23
RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must …
- CVE-2025-14495HIGHCVSS 7.8EG 7.82025-12-23
RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must …
- CVE-2025-14494HIGHCVSS 7.8EG 7.82025-12-23
RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must …
- CVE-2025-14493HIGHCVSS 7.8EG 7.82025-12-23
RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must …
- CVE-2025-14492HIGHCVSS 7.8EG 7.82025-12-23
RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must …
- CVE-2025-14491HIGHCVSS 7.8EG 7.82025-12-23
RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must …
- CVE-2025-14490HIGHCVSS 7.8EG 7.82025-12-23
RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must …
- CVE-2025-14489HIGHCVSS 7.8EG 7.82025-12-23
RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must …
- CVE-2025-14488HIGHCVSS 7.8EG 7.82025-12-23
RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must …
- CVE-2025-47353HIGHCVSS 7.8EG 7.82025-11-04
Memory corruption while processing request sent from GVM.
- CVE-2024-6510HIGHCVSS 7.8EG 7.82024-09-12
Local Privilege Escalation in AVG Internet Security v24 on Windows allows a local unprivileged user to escalate privileges to SYSTEM via COM-Hijacking.
- CVE-2024-6689HIGHCVSS 7.8EG 7.82024-07-15
Local Privilege Escalation in MSI-Installer in baramundi Management Agent v23.1.172.0 on Windows allows a local unprivileged user to escalate privileges to SYSTEM.
- CVE-2023-51577HIGHCVSS 7.8EG 7.82024-05-03
Voltronic Power ViewPower setShutdown Exposed Dangerous Method Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Voltronic Power ViewPower. An attacker m…
- CVE-2023-39493HIGHCVSS 7.8EG 7.82024-05-03
PDF-XChange Editor exportAsText Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is require…
- CVE-2023-37330HIGHCVSS 7.8EG 7.82024-05-03
Kofax Power PDF exportAsText Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to e…
- CVE-2023-27365HIGHCVSS 7.8EG 7.82024-05-03
Foxit PDF Editor DOC File Parsing Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor. User interaction is require…
- CVE-2023-27364HIGHCVSS 7.8EG 7.82024-05-03
Foxit PDF Editor XLS File Parsing Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor. User interaction is require…
- CVE-2023-36853HIGHCVSS 7.8EG 7.82023-07-19
In Keysight Geolocation Server v2.4.2 and prior, a low privileged attacker could create a local ZIP file containing a malicious script in any location. The attacker could abuse this to load a DLL with SYSTEM privileges.
- CVE-2022-37365HIGHCVSS 7.8EG 7.82023-03-29
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malic…
- CVE-2020-12927HIGHCVSS 7.8EG 7.82020-11-12
A potential vulnerability in a dynamically loaded AMD driver in AMD VBIOS Flash Tool SDK may allow any authenticated user to escalate privileges to NT authority system.
- CVE-2020-12928HIGHCVSS 7.8EG 7.82020-10-13
A vulnerability in a dynamically loaded AMD driver in AMD Ryzen Master V15 may allow any authenticated user to escalate privileges to NT authority system.
- CVE-2019-5015HIGHCVSS 7.8EG 7.82019-03-08
A local privilege escalation vulnerability exists in the Mac OS X version of Pixar Renderman 22.3.0's Install Helper helper tool. A user with local access can use this vulnerability to escalate their privileges to root. An attacker would n…
- CVE-2026-44107HIGHCVSS 7.5EG 7.52026-07-30
A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the port that CharxModbusServer is listening, an unauthenticated attacker can perfor…
- CVE-2025-14713HIGHCVSS 7.5EG 7.52026-05-27
An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote attackers to obtain user credentials from the edge server.
- CVE-2026-28400HIGHCVSS 7.5EG 7.52026-02-27
Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Versions prior to 1.0.16 expose a POST `/engines/_configure` endpoint that accepts arbitrary runtime flags without authentication. These flags …
- CVE-2025-37097HIGHCVSS 7.5EG 7.52025-07-01
A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service
- CVE-2025-3698HIGHCVSS 7.5EG 7.52025-04-16
Interface exposure vulnerability in the mobile application (com.transsion.carlcare) may lead to information leakage risk.
- CVE-2024-55921HIGHCVSS 7.5EG 7.52025-01-14
TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forge…
- CVE-2023-51578HIGHCVSS 7.5EG 7.52024-05-03
Voltronic Power ViewPower MonitorConsole Exposed Dangerous Method Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Voltronic Power ViewPower. A…
- CVE-2023-42032HIGHCVSS 7.5EG 7.52024-05-03
Visualware MyConnection Server doRTAAccessUPass Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Visualware MyConnectio…
- CVE-2023-3655HIGHCVSS 7.5EG 7.52023-10-03
cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a dangerous methods, that allows to leak the database (system settings, user accounts,...). This vulnerab…
- CVE-2021-33639HIGHCVSS 7.5EG 7.52023-03-08
REMAP cmd of SVM driver can be used to remap read only memory as read-write, then cause read only memory/file modified.
Map vulnerabilities like CWE-749 to your infrastructure
EchelonGraph correlates every CVE — across CWE-749 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →