CWE-266 · Incorrect Privilege Assignment (page 7)
Page 7 of 12 — CVEs classified under CWE-266, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-60222 | High | 8.8 | 2025-10-22 | Incorrect Privilege Assignment vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Privilege Escalation.This issue affect… |
CVE-2025-60220 | Critical | 9.8 | 2025-10-22 | Incorrect Privilege Assignment vulnerability in pebas CouponXxL couponxxl allows Privilege Escalation.This issue affects CouponXxL: from n/a through <= 3.0.0. |
CVE-2025-60211 | High | 8.8 | 2025-10-22 | Incorrect Privilege Assignment vulnerability in extendons WooCommerce Registration Fields Plugin - Custom Signup Fields extendons-registration-fields allows Pr… |
CVE-2025-59580 | High | 8.8 | 2025-10-22 | Incorrect Privilege Assignment vulnerability in GoodLayers Goodlayers Core goodlayers-core allows Privilege Escalation.This issue affects Goodlayers Core: from… |
CVE-2025-53428 | High | 8.8 | 2025-10-22 | Incorrect Privilege Assignment vulnerability in N-Media Simple User Registration wp-registration allows Privilege Escalation.This issue affects Simple User Reg… |
CVE-2025-53425 | High | 7.2 | 2025-10-22 | Incorrect Privilege Assignment vulnerability in Dokan, Inc. Dokan dokan-lite allows Privilege Escalation.This issue affects Dokan: from n/a through <= 4.1.3. |
CVE-2025-49924 | High | 7.2 | 2025-10-22 | Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite woocommerce-wholesale-prices allows Privilege Escalation.This issue affects Whole… |
CVE-2025-48082 | High | 8.8 | 2025-10-22 | Incorrect Privilege Assignment vulnerability in Progress Planner Progress Planner progress-planner allows Privilege Escalation.This issue affects Progress Plan… |
CVE-2025-62645 | Critical | 9.9 | 2025-10-17 | The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative pr… |
CVE-2025-11853 | Medium | 6.3 | 2025-10-16 | A vulnerability was determined in Sismics Teedy up to 1.11. This affects an unknown function of the file /api/file of the component API Endpoint. Executing a m… |
CVE-2025-10577 | | 2025-10-15 | Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research SECOMN64 driver, which might allow esca… | |
CVE-2025-10576 | | 2025-10-15 | Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research SECOMN64 driver, which might allow esca… | |
CVE-2025-10038 | Medium | 6.5 | 2025-10-15 | The Binary MLM Plan plugin for WordPress is vulnerable to limited Privilege Escalation in all versions up to, and including, 3.0. This is due to bmp_user role… |
CVE-2025-11646 | Medium | 6.3 | 2025-10-12 | A vulnerability was detected in Tomofun Furbo 360 and Furbo Mini. This vulnerability affects unknown code of the component GATT Service. The manipulation resul… |
CVE-2025-11641 | Low | 3.9 | 2025-10-12 | A vulnerability was determined in Tomofun Furbo 360 and Furbo Mini. This impacts an unknown function of the component Trial Restriction Handler. This manipulat… |
CVE-2025-11554 | Medium | 6.3 | 2025-10-09 | A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. Affected by this issue is some unknown functionality of the file app/Http/Contr… |
CVE-2025-11440 | Medium | 4.3 | 2025-10-08 | A vulnerability was determined in JhumanJ OpnForm up to 1.9.3. Impacted is an unknown function of the file /edit. Executing manipulation can lead to improper a… |
CVE-2025-61785 | Low | 3.3 | 2025-10-08 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utim… |
CVE-2025-43914 | High | 7.5 | 2025-10-07 | Dell PowerProtect Data Domain BoostFS for Linux Ubuntu systems of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 r… |
CVE-2025-11281 | Medium | 5.0 | 2025-10-05 | A vulnerability has been found in Frappe LMS 2.35.0. The affected element is an unknown function of the file /courses/ of the component Unpublished Course Hand… |
CVE-2025-11272 | Medium | 5.4 | 2025-10-04 | A vulnerability has been found in SeriaWei ZKEACMS up to 4.3. This affects the function Delete of the file src/ZKEACMS.Redirection/Controllers/UrlRedirectionCo… |
CVE-2025-10725 | Critical | 9.9 | 2025-09-30 | A flaw was found in Red Hat Openshift AI Service. A low-privileged attacker with access to an authenticated account, for example as a data scientist using a st… |
CVE-2025-11080 | Medium | 4.3 | 2025-09-27 | A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4. This vulnerability affects the function selectStudentExamInfoList… |
CVE-2025-11050 | Medium | 6.3 | 2025-09-27 | A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /periodo-lancamento. Executing manipulation can lead to impro… |
CVE-2025-11049 | Medium | 6.3 | 2025-09-27 | A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /unificacao-aluno. Performing… |
CVE-2025-59945 | High | 8.1 | 2025-09-27 | SysReptor is a fully customizable pentest reporting platform. In versions from 2024.74 to before 2025.83, authenticated and unprivileged (non-admin) users can… |
CVE-2025-11048 | Medium | 6.3 | 2025-09-26 | A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /consulta-… |
CVE-2025-11047 | Medium | 6.3 | 2025-09-26 | A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file /module/Api/aluno. This manipulation of the argum… |
CVE-2025-11030 | High | 7.3 | 2025-09-26 | A vulnerability was detected in Tutorials-Website Employee Management System up to 611887d8f8375271ce8abc704507d46340837a60. Impacted is an unknown function of… |
CVE-2025-10992 | Medium | 5.3 | 2025-09-26 | A vulnerability was determined in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. Affected is an unknown function of the file /user/info/look… |
CVE-2025-10989 | Medium | 6.3 | 2025-09-26 | A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This vulnerability affects unknown code of the file /system/role/authUser/selectAll. Pe… |
CVE-2025-10988 | Medium | 6.3 | 2025-09-26 | A vulnerability was identified in YunaiV ruoyi-vue-pro up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Such manipulation leads… |
CVE-2025-10987 | Medium | 6.3 | 2025-09-26 | A vulnerability was determined in YunaiV yudao-cloud up to 2025.09. Affected by this issue is some unknown functionality of the file /crm/contact/transfer of t… |
CVE-2025-10981 | Medium | 4.3 | 2025-09-26 | A vulnerability was detected in JeecgBoot up to 3.8.2. This impacts an unknown function of the file /sys/tenant/exportXls. Performing manipulation results in i… |
CVE-2025-10980 | Medium | 4.3 | 2025-09-26 | A security vulnerability has been detected in JeecgBoot up to 3.8.2. This affects an unknown function of the file /sys/position/exportXls. Such manipulation le… |
CVE-2025-10979 | Medium | 4.3 | 2025-09-25 | A weakness has been identified in JeecgBoot up to 3.8.2. The impacted element is an unknown function of the file /sys/role/exportXls. This manipulation causes… |
CVE-2025-10978 | Medium | 4.3 | 2025-09-25 | A security flaw has been discovered in JeecgBoot up to 3.8.2. The affected element is an unknown function of the file /sys/user/exportXls of the component Filt… |
CVE-2025-10977 | Low | 3.1 | 2025-09-25 | A vulnerability was identified in JeecgBoot up to 3.8.2. Impacted is an unknown function of the file /sys/tenant/deleteBatch. The manipulation of the argument… |
CVE-2025-10976 | Low | 3.1 | 2025-09-25 | A vulnerability was determined in JeecgBoot up to 3.8.2. This issue affects some unknown processing of the file /api/getDepartUserList. Executing manipulation… |
CVE-2025-10941 | High | 7.8 | 2025-09-25 | A vulnerability was determined in Topaz SERVCore Teller 2.14.0-RC2/2.14.1. Affected by this issue is some unknown functionality of the file SERVCoreTeller_2.0… |
CVE-2025-10822 | Medium | 4.3 | 2025-09-23 | A vulnerability has been found in fuyang_lipengjun platform 1.0. The impacted element is the function SysSmsLogController of the file /sys/smslog/queryAll. Suc… |
CVE-2025-10821 | Medium | 4.3 | 2025-09-22 | A flaw has been found in fuyang_lipengjun platform 1.0. The affected element is the function TopicCategoryController of the file /topiccategory/queryAll. This… |
CVE-2025-10820 | Medium | 4.3 | 2025-09-22 | A vulnerability was detected in fuyang_lipengjun platform 1.0. Impacted is the function TopicController of the file /topic/queryAll. The manipulation results i… |
CVE-2025-10819 | Medium | 4.3 | 2025-09-22 | A security vulnerability has been detected in fuyang_lipengjun platform 1.0. This issue affects the function UserCouponController of the file /usercoupon/query… |
CVE-2025-26517 | Medium | 5.4 | 2025-09-19 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a privilege escalation vulnerability. Successful expl… |
CVE-2025-10707 | Medium | 6.3 | 2025-09-19 | A weakness has been identified in JeecgBoot up to 3.8.2. Affected is an unknown function of the file /message/sysMessageTemplate/sendMsg. Executing manipulatio… |
CVE-2025-10676 | Medium | 4.3 | 2025-09-18 | A weakness has been identified in fuyang_lipengjun platform 1.0. Affected is the function BrandController of the file /brand/queryAll. Executing manipulation c… |
CVE-2025-10675 | Medium | 4.3 | 2025-09-18 | A security flaw has been discovered in fuyang_lipengjun platform 1.0. This impacts the function AttributeController of the file /attribute/queryAll. Performing… |
CVE-2025-10674 | Medium | 4.3 | 2025-09-18 | A vulnerability was identified in fuyang_lipengjun platform 1.0. This affects the function AttributeCategoryController of the file /attributecategory/queryAll… |
CVE-2025-10644 | Critical | 9.4 | 2025-09-17 | Wondershare Repairit SAS Token Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authen… |
CVE-2025-10608 | Medium | 6.3 | 2025-09-17 | A vulnerability was detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /enrollment-history/. Performing manipu… |
CVE-2025-10422 | Medium | 4.3 | 2025-09-15 | A vulnerability has been found in newbee-mall up to 613a662adf1da7623ec34459bc83e3c1b12d8ce7. This issue affects the function paySuccess of the file /paySucces… |
CVE-2025-10390 | Medium | 5.4 | 2025-09-14 | A weakness has been identified in CRMEB up to 5.6.1. The affected element is the function editAddress of the file app/services/user/UserAddressServices.php. Ex… |
CVE-2025-10389 | Medium | 5.4 | 2025-09-14 | A security flaw has been discovered in CRMEB up to 5.6.1. Impacted is the function Save of the file app/services/system/admin/SystemAdminServices.php of the co… |
CVE-2025-10384 | Medium | 5.4 | 2025-09-13 | A flaw has been found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is an unknown functionality of the file /system/role/authUser/cancelAl… |
CVE-2025-10374 | High | 7.3 | 2025-09-13 | A security flaw has been discovered in Shenzhen Sixun Business Management System 7/11. This affects an unknown part of the file /Adm/OperatorStop. Performing m… |
CVE-2025-10319 | Medium | 4.3 | 2025-09-12 | A security flaw has been discovered in JeecgBoot up to 3.8.2. Affected by this issue is some unknown functionality of the file /sys/tenant/exportLog of the com… |
CVE-2025-10318 | Medium | 6.3 | 2025-09-12 | A vulnerability was identified in JeecgBoot up to 3.8.2. Affected by this vulnerability is an unknown functionality of the file /api/system/sendWebSocketMsg of… |
CVE-2025-10291 | Medium | 6.3 | 2025-09-12 | A weakness has been identified in linlinjava litemall up to 1.8.0. This affects the function WxAftersaleController of the file /wx/aftersale/cancel. Executing… |
CVE-2025-10278 | Medium | 6.3 | 2025-09-12 | A flaw has been found in YunaiV ruoyi-vue-pro up to 2025.09. Impacted is an unknown function of the file /crm/contact/transfer. This manipulation of the argume… |
CVE-2025-10277 | Medium | 6.3 | 2025-09-12 | A vulnerability was detected in YunaiV yudao-cloud up to 2025.09. This issue affects some unknown processing of the file /crm/receivable/submit. The manipulati… |
CVE-2025-10276 | Medium | 6.3 | 2025-09-12 | A security vulnerability has been detected in YunaiV ruoyi-vue-pro up to 2025.09. This vulnerability affects unknown code of the file /crm/contract/transfer. T… |
CVE-2025-10275 | Medium | 6.3 | 2025-09-12 | A weakness has been identified in YunaiV yudao-cloud up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Executing manipulation of… |
CVE-2025-10247 | Medium | 6.3 | 2025-09-11 | A security vulnerability has been detected in JEPaaS 7.2.8. This vulnerability affects the function doFilterInternal of the component Filter Handler. Such mani… |
CVE-2025-10209 | Medium | 5.4 | 2025-09-10 | A security flaw has been discovered in Papermerge DMS up to 3.5.3. This issue affects some unknown processing of the component Authorization Token Handler. Per… |
CVE-2025-10086 | Medium | 6.3 | 2025-09-08 | A weakness has been identified in fuyang_lipengjun platform 1.0.0. This issue affects the function queryAll of the file /adposition/queryAll of the component A… |
CVE-2025-10084 | Medium | 4.3 | 2025-09-08 | A vulnerability was identified in elunez eladmin up to 2.7. This affects the function queryErrorLogDetail of the file /api/logs/error/1 of the component SysLog… |
CVE-2025-10073 | Medium | 4.3 | 2025-09-08 | A vulnerability was determined in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Api/turma. Executing manipulation can lea… |
CVE-2025-10072 | Medium | 6.3 | 2025-09-07 | A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /matricula/[ID_STUDENT]/enturmar/. Performi… |
CVE-2025-10071 | Medium | 6.3 | 2025-09-07 | A vulnerability has been found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /cancelar-enturmacao-em-lote/. Such manip… |
CVE-2025-10070 | Medium | 6.3 | 2025-09-07 | A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /enturmacao-em-lote/. This manipulation causes improper acces… |
CVE-2025-10014 | Low | 3.1 | 2025-09-05 | A flaw has been found in elunez eladmin up to 2.7. This impacts the function updateUserEmail of the file /api/users/updateEmail/ of the component Email Address… |
CVE-2025-49401 | Critical | 9.8 | 2025-09-05 | Incorrect Privilege Assignment vulnerability in axiomthemes smart SEO smartSEO allows Privilege Escalation.This issue affects smart SEO: from n/a through <= 4… |
CVE-2025-10013 | Medium | 6.3 | 2025-09-05 | A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /exportacao-para-o-seb. Performing manipulation re… |
CVE-2025-58841 | Medium | 5.5 | 2025-09-05 | Incorrect Privilege Assignment vulnerability in John Luetke Media Author media-author allows Privilege Escalation.This issue affects Media Author: from n/a thr… |
CVE-2025-22415 | Medium | 4.0 | 2025-09-04 | In android_app of Android.bp, there is a possible way to launch any activity as a system user. This could lead to local escalation of privilege with no additio… |
CVE-2024-49731 | Medium | 4.0 | 2025-09-04 | In apk-versions.txt, there is a possible corruption of telemetry opt-in settings on other watches when setting up a new Pixel Watch due to a logic error in the… |
CVE-2025-48528 | Medium | 4.0 | 2025-09-04 | In multiple locations, there is a possible way to overlay biometrics due to a tapjacking/overlay attack. This could lead to local escalation of privilege with… |
CVE-2025-48526 | Medium | 4.0 | 2025-09-04 | In createMultiProfilePagerAdapter of ChooserActivity.java , there is a possible way for an app to launch the ChooserActivity in another profile due to improper… |
CVE-2025-26425 | Medium | 4.0 | 2025-09-04 | In multiple functions of RoleService.java, there is a possible permission squatting vulnerability due to a logic error in the code. This could lead to local es… |
CVE-2025-9937 | Medium | 5.4 | 2025-09-04 | A security flaw has been discovered in elunez eladmin 1.1. Impacted is the function deleteFile of the component LocalStorageController. The manipulation result… |
CVE-2025-9936 | Medium | 4.3 | 2025-09-04 | A vulnerability was identified in fuyang_lipengjun platform 1.0.0. This issue affects the function AdController of the file /ad/queryAll. The manipulation lead… |
CVE-2024-32444 | Critical | 9.8 | 2025-09-03 | Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes realhomes allows Privilege Escalation.This issue affects RealHomes: from n/a through <=… |
CVE-2025-9760 | Medium | 6.3 | 2025-09-01 | A weakness has been identified in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/Api/matricula of the component Matricula API… |
CVE-2025-9687 | Medium | 6.3 | 2025-08-30 | A weakness has been identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/HistoricoEscolar/processamentoApi. Execut… |
CVE-2025-9609 | Medium | 6.3 | 2025-08-29 | A vulnerability was found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /educacenso/consulta. The manipulation results… |
CVE-2025-58323 | High | 7.7 | 2025-08-29 | NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by executing arbitrary files due to imp… |
CVE-2025-9602 | Medium | 6.3 | 2025-08-29 | A vulnerability was found in Xinhu RockOA up to 2.6.9. Impacted is the function publicsaveAjax of the file /index.php. Performing manipulation results in impro… |
CVE-2025-49388 | Critical | 9.8 | 2025-08-28 | Incorrect Privilege Assignment vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Privilege Escalation.This issue affects Miraculous Co… |
CVE-2025-48348 | Medium | 4.3 | 2025-08-28 | Incorrect Privilege Assignment vulnerability in chandrashekharsahu Site Offline site-offline allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-58322 | High | 7.8 | 2025-08-28 | NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by invoking arbitrary DLLs due to impro… |
CVE-2025-57797 | High | 7.8 | 2025-08-27 | Incorrect privilege assignment vulnerability exists in ScanSnap Manager installers versions prior to V6.5L61. If this vulnerability is exploited, an authentica… |
CVE-2025-50691 | Medium | 5.3 | 2025-08-22 | MCSManager 10.5.3 daemon process runs as a root account by default, and its sensitive data (including tokens and terminal content) is stored in the data direct… |
CVE-2025-54735 | High | 8.8 | 2025-08-20 | Incorrect Privilege Assignment vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Privilege Escalation.This issue affects CubeWP: from n/a through <… |
CVE-2025-54049 | Critical | 9.9 | 2025-08-20 | Incorrect Privilege Assignment vulnerability in miniOrange Custom API for WP custom-api-for-wp allows Privilege Escalation.This issue affects Custom API for WP… |
CVE-2025-53580 | Critical | 9.8 | 2025-08-20 | Incorrect Privilege Assignment vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows Privilege Escalation.This issue… |
CVE-2025-49422 | Critical | 9.8 | 2025-08-20 | Incorrect Privilege Assignment vulnerability in themepassion Support Ticket support-ticket allows Privilege Escalation.This issue affects Support Ticket: from… |
CVE-2025-48165 | High | 8.8 | 2025-08-20 | Incorrect Privilege Assignment vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Privilege Escalation.This issue affects DELUCKS SEO: from n/a through <=… |
CVE-2025-48164 | High | 8.8 | 2025-08-20 | Incorrect Privilege Assignment vulnerability in Brainstorm Force SureDash suredash allows Privilege Escalation.This issue affects SureDash: from n/a through <=… |
CVE-2025-48142 | High | 8.8 | 2025-08-20 | Incorrect Privilege Assignment vulnerability in Saad Iqbal Bookify bookify allows Privilege Escalation.This issue affects Bookify: from n/a through <= 1.0.9. |