Weaknesses of type CWE-73

768 results

Controle de acesso impróprio

Ocorre quando a aplicação falha em validar adequadamente quem pode acessar um recurso, função ou dado sensível. O código não verifica permissões corretamente — ou não verifica de jeito nenhum — permitindo que usuários não autorizados realizem ações que deveriam estar restritas.

Example

Um endpoint de API que deleta um cliente valida apenas se o usuário está logado, mas não verifica se ele é admin ou proprietário do cliente. Qualquer usuário autenticado consegue deletar qualquer cliente da plataforma.

How to mitigate

Implemente verificação explícita de permissões antes de toda ação sensível: verifique papel (role), escopo e propriedade do recurso. Use padrões como RBAC ou ABAC e teste casos onde usuários tentam acessar dados alheios.

CVE-2025-6691HIGHSureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission DeletionEPSS 1.0%CVE-2026-110385HIGHA remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid InboEPSS 1.0%CVE-2020-2504MEDIUMAbsolute path traversal vulnerability in QESEPSS 1.0%CVE-2026-6101HIGHAMP for WP <= 1.1.12 - Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font UploadEPSS 1.0%CVE-2024-41183HIGHTrend Micro VPN, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite under specific conditions that can lead to elevatioEPSS 1.0%CVE-2026-102146MEDIUMKiteworks Email Protection Gateway Arbitrary File Write through Server-Side Template InjectionEPSS 1.0%CVE-2026-4132HIGHHTTP Headers <= 1.19.2 - Authenticated (Administrator+) External Control of File Name or Path to RCE via 'hh_htpasswd_path' and 'hh_www_authenticate_user' ParametersEPSS 1.0%CVE-2024-12875MEDIUMEasy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File DownloadEPSS 1.0%CVE-2022-43513HIGHA vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 EPSS 1.0%CVE-2026-85520CRITICALUnauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop moduleEPSS 1.0%CVE-2024-4818MEDIUMCampcodes Online Laundry Management System index.php file inclusionEPSS 1.0%CVE-2023-4749MEDIUMSourceCodester Inventory Management System index.php file inclusionEPSS 1.0%CVE-2026-66302CRITICALSkype for Business Remote Code Execution VulnerabilityEPSS 1.0%CVE-2026-50006CRITICALAnyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server ModeEPSS 1.0%CVE-2026-54629HIGHAnyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server ModeEPSS 1.0%CVE-2026-17431MEDIUMPDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_forEPSS 0.9%CVE-2026-67920HIGHAn issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWEPSS 0.9%CVE-2023-4191MEDIUMSourceCodester Resort Reservation System index.php file inclusionEPSS 0.9%CVE-2020-2003MEDIUMPAN-OS: Authenticated administrator can delete arbitrary system fileEPSS 0.9%CVE-2026-16139HIGHArbitrary file write via path traversal in Progress ShareFile Storage Zones Controller potentially leading to remote code executionEPSS 0.9%