Weaknesses of type CWE-749

190 results

Exposição de método ou função perigosa

Uma função ou método sensível fica acessível quando não deveria estar — seja por falta de controle de acesso, visibilidade errada ou ausência de autenticação. Isso permite que atacantes invoquem operações críticas (deletar dados, alterar configurações, executar código) que deveriam ser restritas.

Example

Uma API REST expõe um endpoint `/admin/reset-db` sem autenticação, permitindo qualquer pessoa deletar toda a base de dados. Ou uma classe Java com método `public` que executa operações administrativas, acessível por classes não autorizadas.

How to mitigate

Implemente controle de acesso explícito: valide permissões antes de executar qualquer operação sensível, use visibilidade apropriada (private/protected), autentique e autorize requisições em todas as entradas perigosas, e siga o princípio do menor privilégio.

CVE-2025-24359HIGHASTEVAL Vulnerable to Maliciously Crafted Format Strings Leading to Sandbox EscapeEPSS 0.3%CVE-2024-27261MEDIUMIBM Storage Defender - Resiliency Service privilege escalationEPSS 0.3%CVE-2025-68697HIGHSelf-hosted n8n has Legacy Code node that enables arbitrary file read/writeEPSS 0.3%CVE-2026-66781MEDIUMSubmariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authenticationEPSS 0.3%CVE-2024-55924HIGHCross-Site Request Forgery in Scheduler Module in TYPO3EPSS 0.3%CVE-2024-55893MEDIUMTYPO3 Cross-Site Request Forgery in Log ModuleEPSS 0.2%CVE-2024-55894MEDIUMTYPO3 Cross-Site Request Forgery in Backend User ModuleEPSS 0.2%CVE-2024-29880MEDIUMIn JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent processEPSS 0.2%CVE-2024-55945MEDIUMCross-Site Request Forgery in DB Check Module in TYPO3EPSS 0.2%CVE-2026-28400HIGHDocker Model Runner Unauthenticated Runtime Flag Injection via _configure EndpointEPSS 0.2%CVE-2025-48415MEDIUMBackdoor Functionality via USB Drive in eCharge Hardy Barth cPH2 / cPP2 charging stationsEPSS 0.2%CVE-2026-33583HIGHArqit SKA-Platform Vulnerable to Key ExposureEPSS 0.2%CVE-2025-14492HIGHRealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2025-14488HIGHRealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2025-14491HIGHRealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2025-14489HIGHRealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2025-14490HIGHRealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2023-36853HIGHKeysight Geolocation Server Exposed Dangerous Method or FunctionEPSS 0.2%CVE-2026-45670MEDIUMNuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)EPSS 0.2%CVE-2025-14495HIGHRealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation VulnerabilityEPSS 0.2%