Weaknesses of type CWE-749

217 results

Exposição de método ou função perigosa

Uma função ou método sensível fica acessível quando não deveria estar — seja por falta de controle de acesso, visibilidade errada ou ausência de autenticação. Isso permite que atacantes invoquem operações críticas (deletar dados, alterar configurações, executar código) que deveriam ser restritas.

Example

Uma API REST expõe um endpoint `/admin/reset-db` sem autenticação, permitindo qualquer pessoa deletar toda a base de dados. Ou uma classe Java com método `public` que executa operações administrativas, acessível por classes não autorizadas.

How to mitigate

Implemente controle de acesso explícito: valide permissões antes de executar qualquer operação sensível, use visibilidade apropriada (private/protected), autentique e autorize requisições em todas as entradas perigosas, e siga o princípio do menor privilégio.

CVE-2026-66781MEDIUMSubmariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authenticationEPSS 0.4%CVE-2023-33921MEDIUMA vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05).EPSS 0.4%CVE-2026-35488HIGHTandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) usersEPSS 0.4%CVE-2023-39495MEDIUMPDF-XChange Editor readFileIntoStream Exposed Dangerous Function Information Disclosure VulnerabilityEPSS 0.4%CVE-2023-39505MEDIUMPDF-XChange Editor Net.HTTP.requests Exposed Dangerous Function Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-45805HIGHPenpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCEEPSS 0.4%CVE-2024-13242CRITICALSwift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006EPSS 0.4%CVE-2024-12651HIGHSensitive Data Exposure in PTT Inc.'s HGS Mobile AppEPSS 0.4%CVE-2026-4051HIGHIBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to Server Post-Auth Remote Code ExecutionEPSS 0.4%CVE-2024-55921HIGHCross-Site Request Forgery in Extension Manager Module in TYPO3EPSS 0.4%CVE-2025-43955LOWTwsCachedXPathAPI in Convertigo versions before 8.3.11 did not restrict commons-jxpath functions, which could allow expression injection in EPSS 0.4%CVE-2024-6863MEDIUMEncryption of Arbitrary Files with Attacker-Controlled Key in h2oai/h2o-3EPSS 0.4%CVE-2024-4739MEDIUMMXsecurity License Generation Function DisclosureEPSS 0.4%CVE-2026-116019HIGHGrav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override DirectivesEPSS 0.3%CVE-2020-12927—A potential vulnerability in a dynamically loaded AMD driver in AMD VBIOS Flash Tool SDK may allow any authenticated user to escalate privilEPSS 0.3%CVE-2026-44836MEDIUMview_component: Preview Route Can Dispatch Inherited Helper MethodsEPSS 0.3%CVE-2025-24361MEDIUMOpening a malicious website while running a Nuxt dev server could allow read-only access to codeEPSS 0.3%CVE-2026-118606HIGHAlpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-119978CRITICALFlowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStoreEPSS 0.3%CVE-2020-27123MEDIUMCisco AnyConnect Secure Mobility Client for Windows Arbitrary File Read VulnerabilityEPSS 0.3%