Falhas do tipo CWE-73
768 resultadosControle de acesso inadequado
A aplicação falha em validar ou enforçar corretamente quem pode acessar quais recursos ou funcionalidades. Isso permite que usuários não autorizados executem ações, visualizem dados sensíveis ou acessem áreas administrativas que deveriam estar restritas.
Exemplo
Um sistema bancário que valida se o usuário está logado, mas não verifica se ele tem permissão para acessar a conta de outro cliente — bastaria mudar o ID na URL (ex: `/conta/123` para `/conta/456`) para ver dados alheios.
Como mitigar
Implemente verificações de autorização em todas as operações sensíveis, não confie apenas em obscuridade de URLs ou IDs. Use listas de controle de acesso (ACL) ou papéis (RBAC) centralizados, e valide permissões no servidor antes de retornar qualquer dado ou executar ação.
CVE-2026-30276CRITICALAn arbitrary file overwrite vulnerability in DeftPDF Document Translator v54.0 allows attackers to overwrite critical internal files via theEPSS 0.7%CVE-2024-23634MEDIUMGeoServer arbitrary file renaming vulnerability in REST Coverage/Data Store APIEPSS 0.7%CVE-2026-75602MEDIUMOpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download toolEPSS 0.7%CVE-2026-40342CRITICALFirebird: Path Traversal + Arbitrary File Write Leads to Remote Code ExecutionEPSS 0.7%CVE-2022-42734HIGHA vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service usiEPSS 0.7%CVE-2024-7744MEDIUMImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Progress WS_FTP ServerEPSS 0.7%CVE-2025-64712CRITICALUnstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File WriteEPSS 0.7%CVE-2024-1243CRITICALRemote code execution and local privilege escalation in Wazuh Windows agent via NetNTLMv2 hash theftEPSS 0.7%CVE-2024-0100MEDIUMCVEEPSS 0.7%CVE-2023-20114MEDIUMA vulnerability in the file download feature of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attackEPSS 0.7%CVE-2026-57898CRITICALIn Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to EPSS 0.7%CVE-2026-65941CRITICALWhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.EPSS 0.7%CVE-2025-13322HIGHWP AUDIO GALLERY <= 2.0 - Authenticated (Subscriber+) Arbitrary File Deletion via 'audio_upload' ParameterEPSS 0.7%CVE-2022-45213MEDIUMperfSONAR before 4.4.6 inadvertently supports the parse option for a file:// URL.EPSS 0.7%CVE-2024-38173MEDIUMMicrosoft Outlook Remote Code Execution VulnerabilityEPSS 0.7%CVE-2024-21870MEDIUMA file write vulnerability exists in the OAS Engine Tags Configuration functionality of Open Automation Software OAS Platform V19.00.0057. AEPSS 0.7%CVE-2024-22178MEDIUMA file write vulnerability exists in the OAS Engine Save Security Configuration functionality of Open Automation Software OAS Platform V19.0EPSS 0.7%CVE-2024-39904HIGHCode Execution Vulnerability via Local File Path Traversal in VnoteEPSS 0.7%CVE-2026-54675HIGHFreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang ModuleEPSS 0.7%CVE-2026-73719HIGHAuthenticated Arbitrary File Write Vulnerability leads to Remote Code Execution in HPE Networking Fabric ComposerEPSS 0.7%