CWE-266 · Incorrect Privilege Assignment (page 6)
Page 6 of 12 — CVEs classified under CWE-266, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-1550 | Medium | 6.3 | 2026-01-28 | A security flaw has been discovered in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /hms/hospita… |
CVE-2026-1411 | Medium | 6.1 | 2026-01-26 | A flaw has been found in Beetel 777VR1 up to 01.00.09/01.00.09_55. The affected element is an unknown function of the component UART Interface. This manipulati… |
CVE-2025-69293 | High | 8.8 | 2026-01-22 | Incorrect Privilege Assignment vulnerability in e-plugins Final User final-user allows Privilege Escalation.This issue affects Final User: from n/a through <=… |
CVE-2025-69292 | High | 8.8 | 2026-01-22 | Incorrect Privilege Assignment vulnerability in e-plugins WP Membership wp-membership allows Privilege Escalation.This issue affects WP Membership: from n/a th… |
CVE-2025-69183 | High | 8.8 | 2026-01-22 | Incorrect Privilege Assignment vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Privilege Escalation.This issue affects Ho… |
CVE-2025-69182 | High | 8.8 | 2026-01-22 | Incorrect Privilege Assignment vulnerability in e-plugins Institutions Directory institutions-directory allows Privilege Escalation.This issue affects Institut… |
CVE-2025-68869 | Critical | 9.8 | 2026-01-22 | Incorrect Privilege Assignment vulnerability in LazyCoders LLC LazyTasks lazytasks-project-task-management allows Privilege Escalation.This issue affects LazyT… |
CVE-2025-68027 | High | 7.3 | 2026-01-22 | Incorrect Privilege Assignment vulnerability in Themefic Hydra Booking hydra-booking allows Privilege Escalation.This issue affects Hydra Booking: from n/a thr… |
CVE-2025-67966 | High | 8.8 | 2026-01-22 | Incorrect Privilege Assignment vulnerability in e-plugins Lawyer Directory lawyer-directory allows Privilege Escalation.This issue affects Lawyer Directory: fr… |
CVE-2025-67953 | High | 8.1 | 2026-01-22 | Incorrect Privilege Assignment vulnerability in Booking Activities Team Booking Activities booking-activities allows Privilege Escalation.This issue affects Bo… |
CVE-2025-50007 | High | 8.8 | 2026-01-22 | Incorrect Privilege Assignment vulnerability in Jthemes xSmart xsmart allows Privilege Escalation.This issue affects xSmart: from n/a through <= 1.2.9.4. |
CVE-2026-1193 | Medium | 6.3 | 2026-01-19 | A vulnerability was identified in MineAdmin 1.x/2.x. The impacted element is an unknown function of the file /system/cache/view of the component View Interface… |
CVE-2026-1141 | Medium | 6.3 | 2026-01-19 | A vulnerability was identified in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /admin/add-subadmins.php of the component… |
CVE-2026-1112 | Medium | 5.4 | 2026-01-18 | A vulnerability was found in Sanluan PublicCMS up to 5.202506.d. Affected is the function delete of the file publiccms-trade/src/main/java/com/publiccms/contro… |
CVE-2026-1106 | Medium | 5.4 | 2026-01-18 | A security flaw has been discovered in Chamilo LMS up to 2.0.0 Beta 1. This issue affects the function deleteLegal of the file src/CoreBundle/Controller/Social… |
CVE-2026-23800 | Critical | 10.0 | 2026-01-16 | Incorrect Privilege Assignment vulnerability in Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from 2.5.2 before 2.6.0. |
CVE-2021-47799 | Medium | 6.2 | 2026-01-15 | Visual Tools DVR VX16 version 4.2.28 contains a local privilege escalation vulnerability in its Sudo configuration that allows attackers to gain root access. A… |
CVE-2026-22916 | Medium | 4.3 | 2026-01-15 | An attacker with low privileges may be able to trigger critical system functions such as reboot or factory reset without proper restrictions, potentially leadi… |
CVE-2026-22914 | Medium | 4.3 | 2026-01-15 | An attacker with limited permissions may still be able to write files to specific locations on the device, potentially leading to system manipulation. |
CVE-2026-22908 | Critical | 9.1 | 2026-01-15 | Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity and confidentiality. |
CVE-2026-22907 | Critical | 9.9 | 2026-01-15 | An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data. |
CVE-2026-23550 | Critical | 9.8 | 2026-01-14 | Incorrect Privilege Assignment vulnerability in Modular DS Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from n/a thr… |
CVE-2022-50927 | Medium | 6.2 | 2026-01-13 | Cyclades Serial Console Server 3.3.0 contains a local privilege escalation vulnerability due to overly permissive sudo privileges for the admin user and admin… |
CVE-2026-20852 | High | 7.7 | 2026-01-13 | Incorrect privilege assignment in Windows Hello allows an unauthorized attacker to perform tampering locally. |
CVE-2026-20804 | High | 7.7 | 2026-01-13 | Incorrect privilege assignment in Windows Hello allows an unauthorized attacker to perform tampering locally. |
CVE-2025-67279 | Medium | 5.3 | 2026-01-09 | An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via the application stores password hashe… |
CVE-2025-67278 | Medium | 6.5 | 2026-01-09 | An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via a crafted HTTP request |
CVE-2025-31643 | High | 8.8 | 2026-01-07 | Incorrect Privilege Assignment vulnerability in Dasinfomedia WPCHURCH allows Privilege Escalation.This issue affects WPCHURCH: from n/a through 2.7.0. |
CVE-2025-29004 | High | 8.8 | 2026-01-06 | Incorrect Privilege Assignment vulnerability in AA-Team Premium Age Verification / Restriction for WordPress, AA-Team Responsive Coming Soon Landing Page / Hol… |
CVE-2026-0574 | Medium | 6.3 | 2026-01-04 | A weakness has been identified in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This affects the function saveUserRole of the file warehouse… |
CVE-2025-15213 | Medium | 4.3 | 2025-12-30 | A vulnerability has been found in code-projects Student File Management System 1.0. The affected element is an unknown function of the file /download.php of th… |
CVE-2025-15126 | Low | 3.1 | 2025-12-28 | A weakness has been identified in JeecgBoot up to 3.9.0. Affected by this vulnerability is the function getPositionUserList of the file /sys/position/getPositi… |
CVE-2025-15125 | Low | 3.1 | 2025-12-28 | A security flaw has been discovered in JeecgBoot up to 3.9.0. Affected is the function queryDepartPermission of the file /sys/permission/queryDepartPermission… |
CVE-2025-15124 | Low | 3.1 | 2025-12-28 | A vulnerability was identified in JeecgBoot up to 3.9.0. This impacts the function getParameterMap of the file /sys/sysDepartPermission/list. The manipulation… |
CVE-2025-15123 | Low | 3.1 | 2025-12-28 | A vulnerability was determined in JeecgBoot up to 3.9.0. This affects an unknown function of the file /sys/sysDepartPermission/datarule/. Executing manipulatio… |
CVE-2025-15122 | Low | 3.1 | 2025-12-28 | A vulnerability was found in JeecgBoot up to 3.9.0. The impacted element is the function loadDatarule of the file /sys/sysDepartRole/datarule/. Performing mani… |
CVE-2025-15120 | Low | 3.1 | 2025-12-28 | A flaw has been found in JeecgBoot up to 3.9.0. Impacted is the function getDeptRoleList of the file /sys/sysDepartRole/getDeptRoleList. This manipulation of t… |
CVE-2025-15119 | Low | 3.1 | 2025-12-28 | A vulnerability was detected in JeecgBoot up to 3.9.0. This issue affects the function queryPageList of the file /sys/sysDepartRole/list. The manipulation of t… |
CVE-2025-15118 | Medium | 4.3 | 2025-12-28 | A security vulnerability has been detected in macrozheng mall up to 1.0.3. This vulnerability affects unknown code of the file /member/address/update/ of the c… |
CVE-2025-15106 | Medium | 6.3 | 2025-12-27 | A weakness has been identified in getmaxun maxun up to 0.0.28. The affected element is the function router.get of the file server/src/routes/auth.ts of the com… |
CVE-2025-15087 | Medium | 4.3 | 2025-12-25 | A security vulnerability has been detected in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function submitOrderPayment of the file mall-oms/oms-boot/src… |
CVE-2025-15086 | Medium | 4.3 | 2025-12-25 | A weakness has been identified in youlaitech youlai-mall 1.0.0/2.0.0. This impacts the function getMemberByMobile of the file mall-ums/ums-boot/src/main/java/c… |
CVE-2025-15085 | Medium | 4.3 | 2025-12-25 | A security flaw has been discovered in youlaitech youlai-mall 1.0.0/2.0.0. This affects the function deductBalance of the file mall-ums/ums-boot/src/main/java/… |
CVE-2025-15084 | Low | 3.1 | 2025-12-25 | A vulnerability was identified in youlaitech youlai-mall 1.0.0/2.0.0. The impacted element is the function orderService.payOrder of the file mall-oms/oms-boot/… |
CVE-2019-25249 | Critical | 9.8 | 2025-12-24 | devolo dLAN 500 AV Wireless+ 3.1.0-1 contains an authentication bypass vulnerability that allows attackers to enable hidden services through the htmlmgr CGI sc… |
CVE-2018-25148 | High | 8.8 | 2025-12-24 | Microhard Systems IPn4G 1.1.0 contains multiple authenticated remote code execution vulnerabilities in the admin interface that allow attackers to create cront… |
CVE-2025-14889 | Medium | 5.4 | 2025-12-18 | A security flaw has been discovered in Campcodes Advanced Voting Management System 1.0. The impacted element is an unknown function of the file /admin/voters_e… |
CVE-2025-64188 | Critical | 9.8 | 2025-12-18 | Incorrect Privilege Assignment vulnerability in PenciDesign Soledad soledad allows Privilege Escalation.This issue affects Soledad: from n/a through <= 8.6.9. |
CVE-2025-59134 | High | 8.8 | 2025-12-18 | Incorrect Privilege Assignment vulnerability in Jthemes Sale! Immigration law, Visa services support, Migration Agent Consulting immiex allows Privilege Escala… |
CVE-2025-58710 | High | 8.8 | 2025-12-18 | Incorrect Privilege Assignment vulnerability in e-plugins Hotel Listing hotel-listing allows Privilege Escalation.This issue affects Hotel Listing: from n/a th… |
CVE-2025-55707 | High | 7.2 | 2025-12-18 | Incorrect Privilege Assignment vulnerability in WPXPO PostX ultimate-post allows Privilege Escalation.This issue affects PostX: from n/a through <= 4.1.35. |
CVE-2025-49379 | High | 7.2 | 2025-12-18 | Incorrect Privilege Assignment vulnerability in silverplugins217 Custom Fields Account Registration For Woocommerce custom-fields-account-registration-for-wooc… |
CVE-2025-14749 | Medium | 6.3 | 2025-12-16 | A vulnerability was identified in Ningyuanda TC155 57.0.2.0. This impacts an unknown function of the file /onvif/device_service of the component ONVIF PTZ Cont… |
CVE-2025-14748 | Medium | 5.4 | 2025-12-16 | A vulnerability was determined in Ningyuanda TC155 57.0.2.0. This affects an unknown function of the file /onvif/device_service of the component ONVIF Device M… |
CVE-2025-14503 | High | 7.2 | 2025-12-15 | An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumpt… |
CVE-2025-13888 | Critical | 9.1 | 2025-12-15 | A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources (CRs) that trick the system into granting them elevated permissions i… |
CVE-2025-14660 | Medium | 5.6 | 2025-12-14 | A flaw has been found in DecoCMS Mesh up to 1.0.0-alpha.31. Affected by this vulnerability is the function createTool of the file packages/sdk/src/mcp/teams/ap… |
CVE-2025-65807 | High | 8.4 | 2025-12-10 | An issue in sd command v1.0.0 and before allows attackers to escalate privileges to root via a crafted command. |
CVE-2025-14206 | Medium | 6.5 | 2025-12-08 | A vulnerability was determined in SourceCodester Online Student Clearance System 1.0. The affected element is an unknown function of the file /Admin/delete-fee… |
CVE-2025-14089 | Medium | 6.3 | 2025-12-05 | A vulnerability was identified in Himool ERP up to 2.2. Affected by this issue is the function update_account of the file /api/admin/update_account/ of the com… |
CVE-2025-14088 | Medium | 6.3 | 2025-12-05 | A vulnerability was determined in ketr JEPaaS up to 7.2.8. Affected by this vulnerability is an unknown functionality of the file /je/load. This manipulation o… |
CVE-2025-14086 | Medium | 6.3 | 2025-12-05 | A vulnerability was found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is an unknown function of the file /app-api/v1/members/openid/. The manipulation of t… |
CVE-2025-14052 | Medium | 6.3 | 2025-12-05 | A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected by this vulnerability is the function getMemberById of the file /mall-ums/app-ap… |
CVE-2025-55948 | High | 7.3 | 2025-12-04 | This vulnerability fundamentally arises from yzcheng90 X-SpringBoot 6.0's implementation of role-based access control (RBAC) through dual dependency on fronten… |
CVE-2025-14016 | Medium | 5.4 | 2025-12-04 | A security vulnerability has been detected in macrozheng mall-swarm up to 1.0.3. Affected is the function delete of the file /member/readHistory/delete. Such m… |
CVE-2025-65842 | Medium | 5.1 | 2025-12-03 | The Aquarius HelperTool (1.0.003) privileged XPC service on macOS contains multiple flaws that allow local privilege escalation. The service accepts XPC connec… |
CVE-2025-66296 | High | 8.8 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a privilege escalation vulnerability exists in Grav’s Admin plugin due to the absence of username un… |
CVE-2025-13808 | High | 7.3 | 2025-12-01 | A flaw has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this vulnerability is the function update of the file o… |
CVE-2025-13807 | Medium | 4.3 | 2025-12-01 | A vulnerability was detected in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected is the function MachineKeyController of the file or… |
CVE-2025-13806 | High | 7.3 | 2025-12-01 | A security vulnerability has been detected in nutzam NutzBoot up to 2.6.0-SNAPSHOT. This impacts an unknown function of the file nutzboot-demo/nutzboot-demo-si… |
CVE-2025-13787 | Medium | 5.4 | 2025-11-30 | A flaw has been found in ZenTao up to 21.7.6-8564. The affected element is the function file::delete of the file module/file/control.php of the component File… |
CVE-2025-45311 | High | 8.8 | 2025-11-26 | Insecure permissions in fail2ban-client v0.11.2 allows attackers with limited sudo privileges to perform arbitrary operations as root. NOTE: this is disputed b… |
CVE-2025-64761 | High | 7.2 | 2025-11-25 | OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged operator could use the identity group subsystem to add… |
CVE-2025-13576 | Medium | 6.3 | 2025-11-24 | A vulnerability was detected in code-projects Blog Site 1.0. The affected element is an unknown function of the file /admin.php. Performing manipulation result… |
CVE-2025-0504 | Medium | 5.4 | 2025-11-21 | Black Duck SCA versions prior to 2025.10.0 had user role permissions configured in an overly broad manner. Users with the scoped Project Manager user role with… |
CVE-2025-41115 | Critical | 10.0 | 2025-11-21 | SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing… |
CVE-2025-13443 | Medium | 5.4 | 2025-11-20 | A vulnerability was detected in macrozheng mall up to 1.0.3. Affected by this issue is the function delete of the file /member/readHistory/delete. Performing m… |
CVE-2025-65094 | High | 8.8 | 2025-11-19 | WBCE CMS is a content management system. Prior to version 1.6.4, a low-privileged user in WBCE CMS can escalate their privileges to the Administrators group by… |
CVE-2025-13250 | Medium | 6.3 | 2025-11-16 | A vulnerability was detected in WeiYe-Jing datax-web up to 2.1.2. This impacts the function remove/update/pause/start/triggerJob of the component Job Handler… |
CVE-2025-13131 | High | 7.8 | 2025-11-13 | A vulnerability was found in Sonarr 4.0.15.2940. The impacted element is an unknown function of the file C:\ProgramData\Sonarr\bin\Sonarr.Console.exe of the co… |
CVE-2025-13130 | High | 7.8 | 2025-11-13 | A vulnerability has been found in Radarr 5.28.0.10274. The affected element is an unknown function of the file C:\ProgramData\Radarr\bin\Radarr.Console.exe of… |
CVE-2025-13118 | Medium | 6.3 | 2025-11-13 | A vulnerability was detected in macrozheng mall-swarm up to 1.0.3. Affected by this issue is the function paySuccess of the file /order/paySuccess. The manipul… |
CVE-2025-13117 | Medium | 5.4 | 2025-11-13 | A security vulnerability has been detected in macrozheng mall-swarm and mall up to 1.0.3. Affected by this vulnerability is the function cancelOrder of the fil… |
CVE-2025-13116 | Medium | 5.4 | 2025-11-13 | A weakness has been identified in macrozheng mall-swarm and mall up to 1.0.3. Affected is the function cancelUserOrder of the file /order/cancelUserOrder. Exec… |
CVE-2025-13115 | Medium | 4.3 | 2025-11-13 | A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. This impacts the function detail of the file /order/detail/ of the component… |
CVE-2025-13114 | Medium | 6.3 | 2025-11-13 | A vulnerability was identified in macrozheng mall-swarm up to 1.0.3. This affects the function updateAttr of the file /cart/update/attr. Such manipulation lead… |
CVE-2025-2843 | High | 8.8 | 2025-11-12 | A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-Scoped* Custom Resou… |
CVE-2024-32009 | High | 7.8 | 2025-11-11 | A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to a local privilege escal… |
CVE-2025-63384 | Medium | 6.5 | 2025-11-10 | A vulnerability was discovered in RISC-V Rocket-Chip v1.6 and before implementation where the SRET (Supervisor-mode Exception Return) instruction fails to corr… |
CVE-2025-56503 | Medium | 6.5 | 2025-11-10 | An issue in Sublime HQ Pty Ltd Sublime Text 4 4200 allows authenticated attackers with low-level privileges to escalate privileges to Administrator via replaci… |
CVE-2025-6325 | Critical | 9.8 | 2025-11-06 | Incorrect Privilege Assignment vulnerability in KingAddons.com King Addons for Elementor king-addons allows Privilege Escalation.This issue affects King Addons… |
CVE-2025-62034 | High | 8.8 | 2025-11-06 | Incorrect Privilege Assignment vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4. |
CVE-2025-60243 | Critical | 9.8 | 2025-11-06 | Incorrect Privilege Assignment vulnerability in Holest Engineering Selling Commander for WooCommerce selling-commander-connector allows Privilege Escalation.Th… |
CVE-2025-60195 | Critical | 9.8 | 2025-11-06 | Incorrect Privilege Assignment vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Privilege Escalation.This issue affects Atarim: from n/a t… |
CVE-2025-49900 | High | 8.8 | 2025-11-06 | Incorrect Privilege Assignment vulnerability in bPlugins Advanced scrollbar advanced-scrollbar allows Privilege Escalation.This issue affects Advanced scrollba… |
CVE-2024-58273 | High | 7.8 | 2025-10-30 | Nagios Log Server versions prior to 2024R1.0.2 contain a local privilege escalation vulnerability that allows an attacker who could execute commands as the Apa… |
CVE-2025-12103 | Medium | 5.0 | 2025-10-28 | A flaw was found in Red Hat Openshift AI Service. The TrustyAI component is granting all service accounts and users on a cluster permissions to get, list, wat… |
CVE-2025-36007 | High | 7.8 | 2025-10-27 | IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to privilege escalation due to improper privilege assignment to an update scr… |
CVE-2025-12304 | Medium | 4.3 | 2025-10-27 | A vulnerability has been found in dulaiduwang003 TIME-SEA-PLUS up to fb299162f18498dd9cf17da906886d80a077d53b. This affects the function alipayIsSucceed of the… |
CVE-2025-62007 | High | 8.8 | 2025-10-22 | Incorrect Privilege Assignment vulnerability in bPlugins Voice Feedback voice-feedback allows Privilege Escalation.This issue affects Voice Feedback: from n/a… |