CWE-266 · Incorrect Privilege Assignment (page 10)
Page 10 of 12 — CVEs classified under CWE-266, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-2114 | Low | 3.7 | 2025-03-09 | A vulnerability, which was classified as problematic, has been found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 7. This issue a… |
CVE-2025-2090 | Medium | 4.7 | 2025-03-07 | A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this issue is some unknown functionality of th… |
CVE-2025-2089 | Medium | 5.4 | 2025-03-07 | A vulnerability has been found in StarSea99 starsea-mall 1.0/2.X and classified as critical. Affected by this vulnerability is the function updateUserInfo of t… |
CVE-2025-21092 | Medium | 6.5 | 2025-03-05 | GMOD Apollo does not have sufficient logical or access checks when updating a user's information. This could result in an attacker being able to escalate privi… |
CVE-2025-1881 | Medium | 4.3 | 2025-03-03 | A vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been declared as problematic. Affected by this vulnerability is an unknown functionalit… |
CVE-2024-55570 | Medium | 5.4 | 2025-03-03 | /api/user/users in the web GUI for the Cubro EXA48200 network packet broker (build 20231025055018) fixed in V5.0R14.5P4-V3.3R1 allows remote authenticated user… |
CVE-2025-1847 | Medium | 6.3 | 2025-03-03 | A vulnerability was found in zj1983 zz up to 2024-8. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to impro… |
CVE-2025-1815 | High | 7.3 | 2025-03-02 | A vulnerability, which was classified as critical, was found in pbrong hrms up to 1.0.1. This affects the function HrmsDB of the file \resource\resource.go. Th… |
CVE-2025-1806 | Medium | 4.3 | 2025-03-02 | A vulnerability, which was classified as problematic, has been found in Eastnets PaymentSafe 2.5.26.0. Affected by this issue is some unknown functionality of… |
CVE-2024-8420 | Critical | 9.8 | 2025-02-28 | The DHVC Form plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.7. This is due to the plugin allowing a user… |
CVE-2025-25767 | Medium | 4.8 | 2025-02-21 | A vertical privilege escalation vulnerability in the component /controller/UserController.java of MRCMS v3.1.2 allows attackers to arbitrarily delete users via… |
CVE-2024-56000 | Critical | 9.8 | 2025-02-18 | Incorrect Privilege Assignment vulnerability in SeventhQueen K Elements k-elements allows Privilege Escalation.This issue affects K Elements: from n/a through… |
CVE-2025-26523 | | 2025-02-14 | This vulnerability exists in RupeeWeb trading platform due to insufficient authorization controls on certain API endpoints handling addition and deletion opera… | |
CVE-2025-1226 | Medium | 5.3 | 2025-02-12 | A vulnerability was found in ywoa up to 2024.07.03. It has been declared as critical. This vulnerability affects unknown code of the file /oa/setup/setup.jsp… |
CVE-2024-12213 | Critical | 9.8 | 2025-02-12 | The WP Job Board Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to 2.3.16. This is due to the plugin allowing a user to supp… |
CVE-2024-13421 | Critical | 9.8 | 2025-02-12 | The Real Estate 7 WordPress theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.1. This is due to the plugin no… |
CVE-2024-40591 | High | 8.8 | 2025-02-11 | An incorrect privilege assignment vulnerability [CWE-266] in Fortinet FortiOS version 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.9 and before 7.0.15 allows… |
CVE-2025-1078 | Medium | 5.3 | 2025-02-06 | A vulnerability has been found in AppHouseKitchen AlDente Charge Limiter up to 1.29 on macOS and classified as critical. This vulnerability affects the functio… |
CVE-2024-49348 | Medium | 4.3 | 2025-02-05 | IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 al… |
CVE-2025-24648 | High | 7.5 | 2025-02-04 | Incorrect Privilege Assignment vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Privilege Escalation.This issue affects A… |
CVE-2024-57967 | Medium | 4.2 | 2025-02-03 | PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 has potentially elevated privileges in LDAP mapping. |
CVE-2024-43333 | High | 7.5 | 2025-02-03 | Incorrect Privilege Assignment vulnerability in NotFound Admin and Site Enhancements (ASE) Pro allows Privilege Escalation. This issue affects Admin and Site E… |
CVE-2024-46974 | High | 7.8 | 2025-01-31 | Software installed and run as a non-privileged user may conduct improper read/write operations on imported/exported DMA buffers. |
CVE-2025-0849 | Medium | 6.3 | 2025-01-30 | A vulnerability classified as critical has been found in CampCodes School Management Software 1.0. Affected is an unknown function of the file /edit-staff/ of… |
CVE-2025-0802 | High | 7.3 | 2025-01-29 | A vulnerability classified as critical was found in SourceCodester Best Employee Management System 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2025-0797 | Low | 3.3 | 2025-01-29 | A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been declared as problematic. This vulnerability affects unknown code of the fi… |
CVE-2025-0783 | Medium | 6.3 | 2025-01-28 | A vulnerability, which was classified as problematic, was found in pankajindevops scale up to 20241113. This affects an unknown part of the component API Endpo… |
CVE-2024-35122 | Low | 2.8 | 2025-01-24 | IBM i 7.2, 7.3, 7.4, and 7.5 is vulnerable to a file level local denial of service caused by an insufficient authority requirement. A local non-privileged user… |
CVE-2024-51888 | Critical | 9.8 | 2025-01-21 | Incorrect Privilege Assignment vulnerability in favethemes Homey Login Register homey-login-register allows Privilege Escalation.This issue affects Homey Login… |
CVE-2024-32555 | Critical | 9.8 | 2025-01-21 | Incorrect Privilege Assignment vulnerability in InspiryThemes Easy Real Estate easy-real-estate allows Privilege Escalation.This issue affects Easy Real Estate… |
CVE-2025-23528 | High | 8.8 | 2025-01-16 | Incorrect Privilege Assignment vulnerability in Mosterd3d DD Roles dd-roles allows Privilege Escalation.This issue affects DD Roles: from n/a through <= 4.1. |
CVE-2024-45331 | High | 7.3 | 2025-01-16 | A incorrect privilege assignment vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 all versions… |
CVE-2025-0484 | High | 7.3 | 2025-01-15 | A vulnerability was found in Fanli2012 native-php-cms 1.0 and classified as critical. This issue affects some unknown processing of the file /fladmin/sysconfig… |
CVE-2025-22736 | High | 8.8 | 2025-01-15 | Incorrect Privilege Assignment vulnerability in Saad Iqbal User Management user-management allows Privilege Escalation.This issue affects User Management: from… |
CVE-2024-33503 | Medium | 6.7 | 2025-01-14 | A improper privilege management vulnerability in Fortinet FortiManager Cloud 7.4.1 through 7.4.3, FortiManager Cloud 7.2.1 through 7.2.5, FortiManager Cloud 7… |
CVE-2024-13251 | High | 8.8 | 2025-01-09 | Incorrect Privilege Assignment vulnerability in Drupal Registration role allows Privilege Escalation.This issue affects Registration role: from 0.0.0 before 2… |
CVE-2024-13248 | Medium | 5.5 | 2025-01-09 | Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 befor… |
CVE-2024-13211 | Medium | 6.3 | 2025-01-09 | A vulnerability was found in SingMR HouseRent 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file src/main/jav… |
CVE-2024-13206 | High | 7.8 | 2025-01-09 | A vulnerability classified as critical has been found in REVE Antivirus 1.0.0.0 on Linux. This affects an unknown part of the file /usr/local/reveantivirus/tmp… |
CVE-2024-13200 | High | 7.3 | 2025-01-09 | A vulnerability, which was classified as critical, was found in wander-chu SpringBoot-Blog 1.0. This affects the function preHandle of the file src/main/java/c… |
CVE-2024-13189 | High | 7.3 | 2025-01-08 | A vulnerability classified as critical has been found in ZeroWdd myblog 1.0. This affects an unknown part of the file src/main/java/com/wdd/myblog/config/MyBlo… |
CVE-2024-13188 | Medium | 5.3 | 2025-01-08 | A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been rated as critical. Affected by this issue is some unknown functionality of… |
CVE-2024-56280 | High | 8.8 | 2025-01-07 | Incorrect Privilege Assignment vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Privilege Escalation.This issue affects WPGuppy: from n/… |
CVE-2024-49644 | High | 8.8 | 2025-01-07 | Incorrect Privilege Assignment vulnerability in AllAccessible Accessibility by AllAccessible allaccessible allows Privilege Escalation.This issue affects Acces… |
CVE-2024-12470 | Critical | 9.8 | 2025-01-07 | The School Management System – SakolaWP plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.8. This is due to… |
CVE-2025-0206 | Medium | 5.3 | 2025-01-04 | A vulnerability classified as critical was found in code-projects Online Shoe Store 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2024-56513 | | 2025-01-03 | Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1… | |
CVE-2024-55542 | Medium | 4.4 | 2025-01-02 | Local privilege escalation due to excessive permissions assigned to Tray Monitor service. The following products are affected: Acronis Cyber Protect 16 (Linux… |
CVE-2024-13109 | Medium | 5.3 | 2025-01-02 | A vulnerability was found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. It has been rated as critical. This issue affects som… |
CVE-2024-13108 | Medium | 5.3 | 2025-01-02 | A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. It has been declared as critical. This vulnerability affects unknown code of the file /g… |
CVE-2024-13107 | Medium | 5.3 | 2025-01-02 | A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. It has been classified as critical. This affects an unknown part of the file /goform/for… |
CVE-2024-13106 | Medium | 5.3 | 2025-01-02 | A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210 and classified as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2024-13105 | Medium | 5.3 | 2025-01-02 | A vulnerability has been found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210 and classified as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2024-13104 | Medium | 5.3 | 2025-01-02 | A vulnerability, which was classified as critical, was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. Affected is an unknown function of the file /goform/f… |
CVE-2024-13103 | Medium | 5.3 | 2025-01-02 | A vulnerability, which was classified as critical, has been found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. This issue affects some unknown processing of th… |
CVE-2024-13102 | Medium | 5.3 | 2025-01-02 | A vulnerability classified as critical was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. This vulnerability affects unknown code of the file /goform/DDNS… |
CVE-2024-52049 | High | 7.8 | 2024-12-31 | A LogServer link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. This vulnerabil… |
CVE-2024-52048 | High | 7.8 | 2024-12-31 | A LogServer link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. This vulnerabil… |
CVE-2024-56043 | Critical | 9.8 | 2024-12-31 | Incorrect Privilege Assignment vulnerability in VibeThemes WPLMS wplms_plugin allows Privilege Escalation.This issue affects WPLMS: from n/a through <= 1.9.9. |
CVE-2024-56040 | Critical | 9.8 | 2024-12-31 | Incorrect Privilege Assignment vulnerability in VibeThemes VibeBP vibebp allows Privilege Escalation.This issue affects VibeBP: from n/a through <= 1.9.9.4.1. |
CVE-2024-56205 | Critical | 9.8 | 2024-12-31 | Incorrect Privilege Assignment vulnerability in SunnyKai AI Magic newsletter-page-redirects allows Privilege Escalation.This issue affects AI Magic: from n/a t… |
CVE-2024-56071 | Critical | 9.8 | 2024-12-31 | Incorrect Privilege Assignment vulnerability in mikeleembruggen Simple Dashboard simple-dashboard allows Privilege Escalation.This issue affects Simple Dashboa… |
CVE-2024-56220 | Critical | 9.8 | 2024-12-31 | Incorrect Privilege Assignment vulnerability in sslplugins SSL Wireless SMS Notification ssl-wireless-sms-notification allows Privilege Escalation.This issue a… |
CVE-2024-13067 | Medium | 5.3 | 2024-12-31 | A vulnerability was found in CodeAstro Online Food Ordering System 1.0 and classified as critical. This issue affects some unknown processing of the file /admi… |
CVE-2024-50702 | Medium | 5.4 | 2024-12-30 | TeamPass before 3.1.3.1 does not properly check whether a mail_me (aka action_mail) operation is on behalf of an administrator or manager. |
CVE-2024-50701 | Medium | 4.3 | 2024-12-30 | TeamPass before 3.1.3.1, when retrieving information about access rights for a folder, does not properly check whether a folder is in a user's allowed folders… |
CVE-2024-13030 | High | 7.3 | 2024-12-30 | A vulnerability was found in D-Link DIR-823G 1.0.2B05_20181207. It has been rated as critical. This issue affects the function SetAutoRebootSettings/SetClientI… |
CVE-2024-12901 | Medium | 5.3 | 2024-12-23 | A vulnerability classified as critical was found in FoxCMS up to 1.2. Affected by this vulnerability is an unknown functionality of the file /app/api/controlle… |
CVE-2024-12678 | Medium | 6.5 | 2024-12-20 | Nomad Community and Nomad Enterprise ("Nomad") allocations are vulnerable to privilege escalation within a namespace through unredacted workload identity token… |
CVE-2024-12786 | High | 7.8 | 2024-12-19 | A vulnerability, which was classified as critical, was found in X1a0He Adobe Downloader up to 1.3.1 on macOS. Affected is the function shouldAcceptNewConnectio… |
CVE-2024-12782 | High | 7.3 | 2024-12-19 | A vulnerability has been found in Fujifilm Business Innovation Apeos C3070, Apeos C5570 and Apeos C6580 up to 24.8.28 and classified as critical. This vulnerab… |
CVE-2024-54383 | Critical | 9.8 | 2024-12-18 | Incorrect Privilege Assignment vulnerability in wpweb WooCommerce PDF Vouchers woocommerce-pdf-vouchers allows Privilege Escalation.This issue affects WooComme… |
CVE-2024-9779 | High | 7.5 | 2024-12-17 | A flaw was found in Open Cluster Management (OCM) when a user has access to the worker nodes which contain the cluster-manager or klusterlet deployments. The c… |
CVE-2024-12666 | Medium | 4.7 | 2024-12-16 | A vulnerability has been found in ClassCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin?… |
CVE-2024-54229 | Critical | 9.8 | 2024-12-16 | Incorrect Privilege Assignment vulnerability in straightvisions GmbH SV100 Companion sv100-companion allows Privilege Escalation.This issue affects SV100 Compa… |
CVE-2024-54365 | High | 8.8 | 2024-12-16 | Incorrect Privilege Assignment vulnerability in Knowhalim KH Easy User Settings kh-easy-user-settings allows Privilege Escalation.This issue affects KH Easy Us… |
CVE-2024-54363 | Critical | 9.8 | 2024-12-16 | Incorrect Privilege Assignment vulnerability in saiful.total Wp NssUser Register wp-nssuser-register allows Privilege Escalation.This issue affects Wp NssUser… |
CVE-2024-54293 | Critical | 9.8 | 2024-12-13 | Incorrect Privilege Assignment vulnerability in CE21 CE21 Suite ce21-suite allows Privilege Escalation.This issue affects CE21 Suite: from n/a through <= 2.2.0. |
CVE-2024-12347 | Medium | 5.3 | 2024-12-09 | A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms up to 1.0.0 and classified as critical. This issue affects some unknown processing o… |
CVE-2024-12235 | Medium | 6.3 | 2024-12-05 | A vulnerability was found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 1.0.0. It has been declared as critical. Affected by this vulnerabil… |
CVE-2024-11860 | Medium | 6.5 | 2024-11-27 | A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. This affects an unknown part of the file /rent… |
CVE-2023-26280 | Medium | 5.3 | 2024-11-25 | IBM Jazz Foundation 7.0.2 and 7.0.3 could allow a user to change their dashboard using a specially crafted HTTP request due to improper access control. |
CVE-2024-11486 | Medium | 4.3 | 2024-11-20 | A vulnerability, which was classified as problematic, was found in Code4Berry Decoration Management System 1.0. This affects an unknown part of the file /decor… |
CVE-2024-11485 | Medium | 6.3 | 2024-11-20 | A vulnerability, which was classified as critical, has been found in Code4Berry Decoration Management System 1.0. Affected by this issue is some unknown functi… |
CVE-2024-11484 | Medium | 6.3 | 2024-11-20 | A vulnerability classified as critical was found in Code4Berry Decoration Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-9479 | | 2024-11-20 | Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue affects upKeeper Ins… | |
CVE-2024-9478 | | 2024-11-20 | Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue affects upKeeper Ins… | |
CVE-2024-52442 | Critical | 9.8 | 2024-11-20 | Incorrect Privilege Assignment vulnerability in userplus UserPlus userplus allows Privilege Escalation.This issue affects UserPlus: from n/a through <= 2.0. |
CVE-2024-11306 | Medium | 5.3 | 2024-11-18 | A vulnerability, which was classified as critical, has been found in Altenergy Power Control Software up to 20241108. This issue affects some unknown processin… |
CVE-2020-25720 | High | 7.5 | 2024-11-17 | A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the new… |
CVE-2024-10978 | Medium | 4.2 | 2024-11-14 | Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack require… |
CVE-2024-9476 | | 2024-11-13 | A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within… | |
CVE-2024-29119 | High | 7.8 | 2024-11-12 | A vulnerability has been identified in Spectrum Power 7 (All versions < V24Q3). The affected product contains several root-owned SUID binaries that could allow… |
CVE-2024-47595 | Medium | 6.3 | 2024-11-12 | An attacker who gains local membership to sapsys group could replace local files usually protected by privileged access. On successful exploitation the attacke… |
CVE-2024-11073 | Medium | 4.3 | 2024-11-11 | A vulnerability classified as problematic has been found in SourceCodester Hospital Management System 1.0. This affects an unknown part of the file /vm/patient… |
CVE-2024-45759 | Medium | 6.8 | 2024-11-08 | Dell PowerProtect Data Domain, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an escalation of privilege vulnerability. A local low pr… |
CVE-2024-10766 | Medium | 6.3 | 2024-11-04 | A vulnerability, which was classified as critical, has been found in Codezips Free Exam Hall Seating Management System 1.0. This issue affects some unknown pro… |
CVE-2024-10765 | Medium | 6.3 | 2024-11-04 | A vulnerability classified as critical was found in Codezips Online Institute Management System up to 1.0. This vulnerability affects unknown code of the file… |
CVE-2024-10764 | Medium | 6.3 | 2024-11-04 | A vulnerability classified as critical has been found in Codezips Online Institute Management System 1.0. This affects an unknown part of the file /pages/save_… |
CVE-2024-10654 | Medium | 5.3 | 2024-11-01 | A vulnerability has been found in TOTOLINK LR350 up to 9.3.5u.6369 and classified as critical. Affected by this vulnerability is an unknown functionality of th… |