Weaknesses of type CWE-749

217 results

Exposição de método ou função perigosa

Uma função ou método sensível fica acessível quando não deveria estar — seja por falta de controle de acesso, visibilidade errada ou ausência de autenticação. Isso permite que atacantes invoquem operações críticas (deletar dados, alterar configurações, executar código) que deveriam ser restritas.

Example

Uma API REST expõe um endpoint `/admin/reset-db` sem autenticação, permitindo qualquer pessoa deletar toda a base de dados. Ou uma classe Java com método `public` que executa operações administrativas, acessível por classes não autorizadas.

How to mitigate

Implemente controle de acesso explícito: valide permissões antes de executar qualquer operação sensível, use visibilidade apropriada (private/protected), autentique e autorize requisições em todas as entradas perigosas, e siga o princípio do menor privilégio.

CVE-2025-14494HIGHRealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2025-14489HIGHRealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2025-14491HIGHRealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2025-14496HIGHRealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2025-14493HIGHRealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2025-14495HIGHRealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2024-55920MEDIUMCross-Site Request Forgery in Dashboard Module in TYPO3EPSS 0.2%CVE-2024-55923MEDIUMCross-Site Request Forgery in Indexed Search Module in TYPO3EPSS 0.2%CVE-2024-55922MEDIUMCross-Site Request Forgery in Form Framework Module in TYPO3EPSS 0.2%CVE-2024-6689HIGHLocal privilege escalation vulnerability in baramundi Management Agent via MSI InstallerEPSS 0.2%CVE-2026-68928HIGHAcode: Exported TerminalService (bundled terminal plugin) lets any installed app execute arbitrary shell commands as AcodeEPSS 0.2%CVE-2025-34114HIGHOpenBlow Missing Critical Security HeadersEPSS 0.2%CVE-2026-102667CRITICALJoyland AI WebView command injectionEPSS 0.2%CVE-2026-20293HIGHCisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass VulnerabilityEPSS 0.2%CVE-2026-18262HIGHParallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2026-7516MEDIUMA vulnerability was identified in the Lenovo Android Application, distributed exclusively on tablets in the Chinese market, that could allowEPSS 0.2%CVE-2026-13121HIGHParallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2026-18263HIGHParallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2026-48783MEDIUMPostiz has an unauthenticated billing-enforcement bypass via /public/modify-subscriptionEPSS 0.2%CVE-2026-113775HIGHDynamic Library Loading Process Control in Autodesk Fusion DesktopEPSS 0.2%