119 vulnerabilities classified as CWE-749 (暴露危险的方法或函数). AI Chinese analysis included.
CWE-749 represents a critical architectural flaw where an application exposes a dangerous method or function through its API without adequate access controls. This weakness occurs when developers fail to restrict sensitive operations, allowing external actors to invoke functions that should remain internal or privileged. Attackers typically exploit this by directly calling these unrestricted endpoints to bypass intended security logic, potentially leading to unauthorized data access, privilege escalation, or system compromise. The severity depends on the specific function exposed, ranging from information disclosure to complete system takeover. To mitigate this risk, developers must implement strict authentication and authorization checks on all API endpoints. Additionally, adhering to the principle of least privilege ensures that only necessary methods are exposed, while comprehensive input validation and regular security audits help identify and remediate improperly secured interfaces before they can be weaponized by malicious actors.
public void removeDatabase(String databaseName) { try { Statement stmt = conn.createStatement(); stmt.execute("DROP DATABASE " + databaseName); } catch (SQLException ex) {...} }private void removeDatabase(String databaseName) { try { Statement stmt = conn.createStatement(); stmt.execute("DROP DATABASE " + databaseName); } catch (SQLException ex) {...} }// Android @Override public boolean shouldOverrideUrlLoading(WebView view, String url){ if (url.substring(0,14).equalsIgnoreCase("examplescheme:")){ if(url.substring(14,25).equalsIgnoreCase("getUserInfo")){ writeDataToView(view, UserData); return false; } else{ return true; } } }// iOS -(BOOL) webView:(UIWebView *)exWebView shouldStartLoadWithRequest:(NSURLRequest *)exRequest navigationType:(UIWebViewNavigationType)exNavigationType { NSURL *URL = [exRequest URL]; if ([[URL scheme] isEqualToString:@"exampleScheme"]) { NSString *functionString = [URL resourceSpecifier]; if ([functionString hasPrefix:@"specialFunction"]) { // Make data available back in webview. UIWebView *webView = [self writeDataToView:[URL query]]; } return NO; } return YES; }Vulnerabilities classified as CWE-749 (暴露危险的方法或函数) represent 119 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.