CWE-266 · Incorrect Privilege Assignment (page 6)
Page 6 of 11 — CVEs classified under CWE-266, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-11272 | Medium | 5.4 | 2025-10-04 | A vulnerability has been found in SeriaWei ZKEACMS up to 4.3. This affects the function Delete of the file src/ZKEACMS.Redirection/Controllers/UrlRedirectionCo… |
CVE-2025-10725 | Critical | 9.9 | 2025-09-30 | A flaw was found in Red Hat Openshift AI Service. A low-privileged attacker with access to an authenticated account, for example as a data scientist using a st… |
CVE-2025-11080 | Medium | 4.3 | 2025-09-27 | A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4. This vulnerability affects the function selectStudentExamInfoList… |
CVE-2025-11050 | Medium | 6.3 | 2025-09-27 | A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /periodo-lancamento. Executing manipulation can lead to impro… |
CVE-2025-11049 | Medium | 6.3 | 2025-09-27 | A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /unificacao-aluno. Performing… |
CVE-2025-59945 | High | 8.1 | 2025-09-27 | SysReptor is a fully customizable pentest reporting platform. In versions from 2024.74 to before 2025.83, authenticated and unprivileged (non-admin) users can… |
CVE-2025-11048 | Medium | 6.3 | 2025-09-26 | A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /consulta-… |
CVE-2025-11047 | Medium | 6.3 | 2025-09-26 | A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file /module/Api/aluno. This manipulation of the argum… |
CVE-2025-11030 | High | 7.3 | 2025-09-26 | A vulnerability was detected in Tutorials-Website Employee Management System up to 611887d8f8375271ce8abc704507d46340837a60. Impacted is an unknown function of… |
CVE-2025-10992 | Medium | 5.3 | 2025-09-26 | A vulnerability was determined in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. Affected is an unknown function of the file /user/info/look… |
CVE-2025-10989 | Medium | 6.3 | 2025-09-26 | A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This vulnerability affects unknown code of the file /system/role/authUser/selectAll. Pe… |
CVE-2025-10988 | Medium | 6.3 | 2025-09-26 | A vulnerability was identified in YunaiV ruoyi-vue-pro up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Such manipulation leads… |
CVE-2025-10987 | Medium | 6.3 | 2025-09-26 | A vulnerability was determined in YunaiV yudao-cloud up to 2025.09. Affected by this issue is some unknown functionality of the file /crm/contact/transfer of t… |
CVE-2025-10981 | Medium | 4.3 | 2025-09-26 | A vulnerability was detected in JeecgBoot up to 3.8.2. This impacts an unknown function of the file /sys/tenant/exportXls. Performing manipulation results in i… |
CVE-2025-10980 | Medium | 4.3 | 2025-09-26 | A security vulnerability has been detected in JeecgBoot up to 3.8.2. This affects an unknown function of the file /sys/position/exportXls. Such manipulation le… |
CVE-2025-10979 | Medium | 4.3 | 2025-09-25 | A weakness has been identified in JeecgBoot up to 3.8.2. The impacted element is an unknown function of the file /sys/role/exportXls. This manipulation causes… |
CVE-2025-10978 | Medium | 4.3 | 2025-09-25 | A security flaw has been discovered in JeecgBoot up to 3.8.2. The affected element is an unknown function of the file /sys/user/exportXls of the component Filt… |
CVE-2025-10977 | Low | 3.1 | 2025-09-25 | A vulnerability was identified in JeecgBoot up to 3.8.2. Impacted is an unknown function of the file /sys/tenant/deleteBatch. The manipulation of the argument… |
CVE-2025-10976 | Low | 3.1 | 2025-09-25 | A vulnerability was determined in JeecgBoot up to 3.8.2. This issue affects some unknown processing of the file /api/getDepartUserList. Executing manipulation… |
CVE-2025-10941 | High | 7.8 | 2025-09-25 | A vulnerability was determined in Topaz SERVCore Teller 2.14.0-RC2/2.14.1. Affected by this issue is some unknown functionality of the file SERVCoreTeller_2.0… |
CVE-2025-10822 | Medium | 4.3 | 2025-09-23 | A vulnerability has been found in fuyang_lipengjun platform 1.0. The impacted element is the function SysSmsLogController of the file /sys/smslog/queryAll. Suc… |
CVE-2025-10821 | Medium | 4.3 | 2025-09-22 | A flaw has been found in fuyang_lipengjun platform 1.0. The affected element is the function TopicCategoryController of the file /topiccategory/queryAll. This… |
CVE-2025-10820 | Medium | 4.3 | 2025-09-22 | A vulnerability was detected in fuyang_lipengjun platform 1.0. Impacted is the function TopicController of the file /topic/queryAll. The manipulation results i… |
CVE-2025-10819 | Medium | 4.3 | 2025-09-22 | A security vulnerability has been detected in fuyang_lipengjun platform 1.0. This issue affects the function UserCouponController of the file /usercoupon/query… |
CVE-2025-26517 | Medium | 5.4 | 2025-09-19 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a privilege escalation vulnerability. Successful expl… |
CVE-2025-10707 | Medium | 6.3 | 2025-09-19 | A weakness has been identified in JeecgBoot up to 3.8.2. Affected is an unknown function of the file /message/sysMessageTemplate/sendMsg. Executing manipulatio… |
CVE-2025-10676 | Medium | 4.3 | 2025-09-18 | A weakness has been identified in fuyang_lipengjun platform 1.0. Affected is the function BrandController of the file /brand/queryAll. Executing manipulation c… |
CVE-2025-10675 | Medium | 4.3 | 2025-09-18 | A security flaw has been discovered in fuyang_lipengjun platform 1.0. This impacts the function AttributeController of the file /attribute/queryAll. Performing… |
CVE-2025-10674 | Medium | 4.3 | 2025-09-18 | A vulnerability was identified in fuyang_lipengjun platform 1.0. This affects the function AttributeCategoryController of the file /attributecategory/queryAll… |
CVE-2025-10644 | Critical | 9.4 | 2025-09-17 | Wondershare Repairit SAS Token Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authen… |
CVE-2025-10608 | Medium | 6.3 | 2025-09-17 | A vulnerability was detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /enrollment-history/. Performing manipu… |
CVE-2025-10422 | Medium | 4.3 | 2025-09-15 | A vulnerability has been found in newbee-mall up to 613a662adf1da7623ec34459bc83e3c1b12d8ce7. This issue affects the function paySuccess of the file /paySucces… |
CVE-2025-10390 | Medium | 5.4 | 2025-09-14 | A weakness has been identified in CRMEB up to 5.6.1. The affected element is the function editAddress of the file app/services/user/UserAddressServices.php. Ex… |
CVE-2025-10389 | Medium | 5.4 | 2025-09-14 | A security flaw has been discovered in CRMEB up to 5.6.1. Impacted is the function Save of the file app/services/system/admin/SystemAdminServices.php of the co… |
CVE-2025-10384 | Medium | 5.4 | 2025-09-13 | A flaw has been found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is an unknown functionality of the file /system/role/authUser/cancelAl… |
CVE-2025-10374 | High | 7.3 | 2025-09-13 | A security flaw has been discovered in Shenzhen Sixun Business Management System 7/11. This affects an unknown part of the file /Adm/OperatorStop. Performing m… |
CVE-2025-10319 | Medium | 4.3 | 2025-09-12 | A security flaw has been discovered in JeecgBoot up to 3.8.2. Affected by this issue is some unknown functionality of the file /sys/tenant/exportLog of the com… |
CVE-2025-10318 | Medium | 6.3 | 2025-09-12 | A vulnerability was identified in JeecgBoot up to 3.8.2. Affected by this vulnerability is an unknown functionality of the file /api/system/sendWebSocketMsg of… |
CVE-2025-10291 | Medium | 6.3 | 2025-09-12 | A weakness has been identified in linlinjava litemall up to 1.8.0. This affects the function WxAftersaleController of the file /wx/aftersale/cancel. Executing… |
CVE-2025-10278 | Medium | 6.3 | 2025-09-12 | A flaw has been found in YunaiV ruoyi-vue-pro up to 2025.09. Impacted is an unknown function of the file /crm/contact/transfer. This manipulation of the argume… |
CVE-2025-10277 | Medium | 6.3 | 2025-09-12 | A vulnerability was detected in YunaiV yudao-cloud up to 2025.09. This issue affects some unknown processing of the file /crm/receivable/submit. The manipulati… |
CVE-2025-10276 | Medium | 6.3 | 2025-09-12 | A security vulnerability has been detected in YunaiV ruoyi-vue-pro up to 2025.09. This vulnerability affects unknown code of the file /crm/contract/transfer. T… |
CVE-2025-10275 | Medium | 6.3 | 2025-09-12 | A weakness has been identified in YunaiV yudao-cloud up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Executing manipulation of… |
CVE-2025-10247 | Medium | 6.3 | 2025-09-11 | A security vulnerability has been detected in JEPaaS 7.2.8. This vulnerability affects the function doFilterInternal of the component Filter Handler. Such mani… |
CVE-2025-10209 | Medium | 5.4 | 2025-09-10 | A security flaw has been discovered in Papermerge DMS up to 3.5.3. This issue affects some unknown processing of the component Authorization Token Handler. Per… |
CVE-2025-10086 | Medium | 6.3 | 2025-09-08 | A weakness has been identified in fuyang_lipengjun platform 1.0.0. This issue affects the function queryAll of the file /adposition/queryAll of the component A… |
CVE-2025-10084 | Medium | 4.3 | 2025-09-08 | A vulnerability was identified in elunez eladmin up to 2.7. This affects the function queryErrorLogDetail of the file /api/logs/error/1 of the component SysLog… |
CVE-2025-10073 | Medium | 4.3 | 2025-09-08 | A vulnerability was determined in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Api/turma. Executing manipulation can lea… |
CVE-2025-10072 | Medium | 6.3 | 2025-09-07 | A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /matricula/[ID_STUDENT]/enturmar/. Performi… |
CVE-2025-10071 | Medium | 6.3 | 2025-09-07 | A vulnerability has been found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /cancelar-enturmacao-em-lote/. Such manip… |
CVE-2025-10070 | Medium | 6.3 | 2025-09-07 | A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /enturmacao-em-lote/. This manipulation causes improper acces… |
CVE-2025-10014 | Low | 3.1 | 2025-09-05 | A flaw has been found in elunez eladmin up to 2.7. This impacts the function updateUserEmail of the file /api/users/updateEmail/ of the component Email Address… |
CVE-2025-49401 | Critical | 9.8 | 2025-09-05 | Incorrect Privilege Assignment vulnerability in axiomthemes smart SEO smartSEO allows Privilege Escalation.This issue affects smart SEO: from n/a through <= 4… |
CVE-2025-10013 | Medium | 6.3 | 2025-09-05 | A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /exportacao-para-o-seb. Performing manipulation re… |
CVE-2025-58841 | Medium | 5.5 | 2025-09-05 | Incorrect Privilege Assignment vulnerability in John Luetke Media Author media-author allows Privilege Escalation.This issue affects Media Author: from n/a thr… |
CVE-2025-22415 | Medium | 4.0 | 2025-09-04 | In android_app of Android.bp, there is a possible way to launch any activity as a system user. This could lead to local escalation of privilege with no additio… |
CVE-2024-49731 | Medium | 4.0 | 2025-09-04 | In apk-versions.txt, there is a possible corruption of telemetry opt-in settings on other watches when setting up a new Pixel Watch due to a logic error in the… |
CVE-2025-48528 | Medium | 4.0 | 2025-09-04 | In multiple locations, there is a possible way to overlay biometrics due to a tapjacking/overlay attack. This could lead to local escalation of privilege with… |
CVE-2025-48526 | Medium | 4.0 | 2025-09-04 | In createMultiProfilePagerAdapter of ChooserActivity.java , there is a possible way for an app to launch the ChooserActivity in another profile due to improper… |
CVE-2025-26425 | Medium | 4.0 | 2025-09-04 | In multiple functions of RoleService.java, there is a possible permission squatting vulnerability due to a logic error in the code. This could lead to local es… |
CVE-2025-9937 | Medium | 5.4 | 2025-09-04 | A security flaw has been discovered in elunez eladmin 1.1. Impacted is the function deleteFile of the component LocalStorageController. The manipulation result… |
CVE-2025-9936 | Medium | 4.3 | 2025-09-04 | A vulnerability was identified in fuyang_lipengjun platform 1.0.0. This issue affects the function AdController of the file /ad/queryAll. The manipulation lead… |
CVE-2024-32444 | Critical | 9.8 | 2025-09-03 | Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes realhomes allows Privilege Escalation.This issue affects RealHomes: from n/a through <=… |
CVE-2025-9760 | Medium | 6.3 | 2025-09-01 | A weakness has been identified in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/Api/matricula of the component Matricula API… |
CVE-2025-9687 | Medium | 6.3 | 2025-08-30 | A weakness has been identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/HistoricoEscolar/processamentoApi. Execut… |
CVE-2025-9609 | Medium | 6.3 | 2025-08-29 | A vulnerability was found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /educacenso/consulta. The manipulation results… |
CVE-2025-58323 | High | 7.7 | 2025-08-29 | NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by executing arbitrary files due to imp… |
CVE-2025-9602 | Medium | 6.3 | 2025-08-29 | A vulnerability was found in Xinhu RockOA up to 2.6.9. Impacted is the function publicsaveAjax of the file /index.php. Performing manipulation results in impro… |
CVE-2025-49388 | Critical | 9.8 | 2025-08-28 | Incorrect Privilege Assignment vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Privilege Escalation.This issue affects Miraculous Co… |
CVE-2025-48348 | Medium | 4.3 | 2025-08-28 | Incorrect Privilege Assignment vulnerability in chandrashekharsahu Site Offline site-offline allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-58322 | High | 7.8 | 2025-08-28 | NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by invoking arbitrary DLLs due to impro… |
CVE-2025-57797 | High | 7.8 | 2025-08-27 | Incorrect privilege assignment vulnerability exists in ScanSnap Manager installers versions prior to V6.5L61. If this vulnerability is exploited, an authentica… |
CVE-2025-50691 | Medium | 5.3 | 2025-08-22 | MCSManager 10.5.3 daemon process runs as a root account by default, and its sensitive data (including tokens and terminal content) is stored in the data direct… |
CVE-2025-54735 | High | 8.8 | 2025-08-20 | Incorrect Privilege Assignment vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Privilege Escalation.This issue affects CubeWP: from n/a through <… |
CVE-2025-54049 | Critical | 9.9 | 2025-08-20 | Incorrect Privilege Assignment vulnerability in miniOrange Custom API for WP custom-api-for-wp allows Privilege Escalation.This issue affects Custom API for WP… |
CVE-2025-53580 | Critical | 9.8 | 2025-08-20 | Incorrect Privilege Assignment vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows Privilege Escalation.This issue… |
CVE-2025-49422 | Critical | 9.8 | 2025-08-20 | Incorrect Privilege Assignment vulnerability in themepassion Support Ticket support-ticket allows Privilege Escalation.This issue affects Support Ticket: from… |
CVE-2025-48165 | High | 8.8 | 2025-08-20 | Incorrect Privilege Assignment vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Privilege Escalation.This issue affects DELUCKS SEO: from n/a through <=… |
CVE-2025-48164 | High | 8.8 | 2025-08-20 | Incorrect Privilege Assignment vulnerability in Brainstorm Force SureDash suredash allows Privilege Escalation.This issue affects SureDash: from n/a through <=… |
CVE-2025-48142 | High | 8.8 | 2025-08-20 | Incorrect Privilege Assignment vulnerability in Saad Iqbal Bookify bookify allows Privilege Escalation.This issue affects Bookify: from n/a through <= 1.0.9. |
CVE-2025-9151 | Medium | 6.3 | 2025-08-19 | A security flaw has been discovered in LiuYuYang01 ThriveX-Blog up to 3.1.7. Affected by this vulnerability is the function updateJsonValueByName of the file /… |
CVE-2025-5417 | Medium | 6.1 | 2025-08-19 | An insufficient access control vulnerability was found in the Red Hat Developer Hub rhdh/rhdh-hub-rhel9 container image. The Red Hat Developer Hub cluster admi… |
CVE-2017-20199 | Low | 3.1 | 2025-08-16 | A vulnerability was found in Buttercup buttercup-browser-extension up to 0.14.2. Affected by this vulnerability is an unknown functionality of the component Va… |
CVE-2025-38738 | Medium | 6.7 | 2025-08-14 | SupportAssist for Home PCs Installer exe version(s) 4.8.2.29006 and prior, contain(s) an Incorrect Privilege Assignment vulnerability in the Installer. A low p… |
CVE-2025-36613 | Low | 2.8 | 2025-08-14 | SupportAssist for Home PCs versions 4.6.3 and prior and SupportAssist for Business PCs versions 4.5.3 and prior, contain(s) an Incorrect Privilege Assignment v… |
CVE-2025-36612 | Medium | 6.7 | 2025-08-14 | SupportAssist for Business PCs, version(s) 4.5.3 and prior, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local ac… |
CVE-2025-54697 | High | 7.2 | 2025-08-14 | Incorrect Privilege Assignment vulnerability in StellarWP Kadence WooCommerce Email Designer kadence-woocommerce-email-designer allows Privilege Escalation.Thi… |
CVE-2024-12303 | Medium | 6.7 | 2025-08-13 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain cond… |
CVE-2025-53744 | High | 7.2 | 2025-08-12 | An incorrect privilege assignment vulnerability [CWE-266] in FortiOS Security Fabric version 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.0 al… |
CVE-2025-42936 | Medium | 5.4 | 2025-08-12 | The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user roles, this issue allo… |
CVE-2025-8840 | Medium | 5.4 | 2025-08-11 | A vulnerability was determined in jshERP up to 3.5. Affected is an unknown function of the file /jshERP-boot/user/deleteBatch of the component Endpoint. The ma… |
CVE-2025-8839 | Medium | 6.3 | 2025-08-11 | A vulnerability was found in jshERP up to 3.5. This issue affects some unknown processing of the file /jshERP-boot/user/addUser of the component Endpoint. The… |
CVE-2025-8797 | Medium | 6.3 | 2025-08-10 | A vulnerability was found in LitmusChaos Litmus up to 3.19.0 and classified as critical. This issue affects some unknown processing of the component LocalStora… |
CVE-2025-8795 | Medium | 6.3 | 2025-08-10 | A vulnerability, which was classified as critical, was found in LitmusChaos Litmus up to 3.19.0. This affects an unknown part of the file /auth/login. The mani… |
CVE-2025-8791 | Medium | 6.3 | 2025-08-10 | A vulnerability was found in LitmusChaos Litmus up to 3.19.0. It has been rated as critical. This issue affects some unknown processing of the file /auth/list_… |
CVE-2025-8790 | Medium | 4.3 | 2025-08-10 | A vulnerability was found in Portabilis i-Educar up to 2.9.0. It has been declared as critical. This vulnerability affects unknown code of the file /module/Api… |
CVE-2025-8758 | High | 7.0 | 2025-08-09 | A vulnerability was found in TRENDnet TEW-822DRE FW103B02. It has been classified as problematic. This affects an unknown part of the component vsftpd. The man… |
CVE-2025-8757 | High | 7.0 | 2025-08-09 | A vulnerability was found in TRENDnet TV-IP110WN 1.2.2 and classified as problematic. Affected by this issue is some unknown functionality of the file /server/… |
CVE-2025-8756 | Medium | 6.3 | 2025-08-09 | A vulnerability has been found in TDuckCloud tduck-platform up to 5.1 and classified as critical. Affected by this vulnerability is the function preHandle of t… |
CVE-2025-8547 | Medium | 5.3 | 2025-08-05 | A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as critical. This vulnerability affects unknown code of the component Email Verificati… |