Falhas do tipo CWE-73
768 resultadosControle de acesso inadequado
A aplicação falha em validar ou enforçar corretamente quem pode acessar quais recursos ou funcionalidades. Isso permite que usuários não autorizados executem ações, visualizem dados sensíveis ou acessem áreas administrativas que deveriam estar restritas.
Exemplo
Um sistema bancário que valida se o usuário está logado, mas não verifica se ele tem permissão para acessar a conta de outro cliente — bastaria mudar o ID na URL (ex: `/conta/123` para `/conta/456`) para ver dados alheios.
Como mitigar
Implemente verificações de autorização em todas as operações sensíveis, não confie apenas em obscuridade de URLs ou IDs. Use listas de controle de acesso (ACL) ou papéis (RBAC) centralizados, e valide permissões no servidor antes de retornar qualquer dado ou executar ação.
CVE-2026-73719HIGHAuthenticated Arbitrary File Write Vulnerability leads to Remote Code Execution in HPE Networking Fabric ComposerEPSS 0.7%CVE-2026-48162CRITICALWazuh: cluster peer can read arbitrary master files and forge offline REST API administrator tokens via DAPI tmp_file path injection in Wazuh managerEPSS 0.7%CVE-2024-7497MEDIUMitsourcecode Airline Reservation System index.php file inclusionEPSS 0.7%CVE-2024-7496MEDIUMitsourcecode Airline Reservation System index.php file inclusionEPSS 0.7%CVE-2025-9048HIGHWptobe-memberships <= 3.4.2 - Authenticated (Subscriber+) Arbitrary File DeletionEPSS 0.7%CVE-2025-66292HIGHDPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interfaceEPSS 0.6%CVE-2024-55372CRITICALWallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by EPSS 0.6%CVE-2025-3812HIGHWPBot Pro Wordpress Chatbot <= 13.6.2 - Authenticated (Subscriber+) Arbitrary File DeletionEPSS 0.6%CVE-2025-5393CRITICALAlone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary File DeletionEPSS 0.6%CVE-2024-10834CRITICALArbitrary File Write in eosphoros-ai/db-gptEPSS 0.6%CVE-2026-58192HIGHAppium: Unauthenticated arbitrary file/directory deletion in @appium/storage-pluginEPSS 0.6%CVE-2025-10058HIGHWP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File DeletionEPSS 0.6%CVE-2026-85176HIGHDbGate through 7.2.6 Arbitrary File Read and Write via file:// jslidEPSS 0.6%CVE-2025-8422HIGHPropovoice <= 1.7.6.7 - Unauthenticated Arbitrary File ReadEPSS 0.6%CVE-2024-55371CRITICALWallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uploEPSS 0.6%CVE-2026-69783HIGHWindows Update Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2026-82393HIGHpnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on installEPSS 0.6%CVE-2026-85603HIGHGrav Admin Plugin Path Traversal via Save As Language CodeEPSS 0.6%CVE-2023-36634MEDIUMAn incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-U 7.EPSS 0.6%CVE-2025-53912CRITICALAn arbitrary file read vulnerability exists in the encapsulatedDoc functionality of MedDream PACS Premium 7.3.6.870. A specially crafted HTTEPSS 0.6%