CWE-266 · Incorrect Privilege Assignment (page 7)
Page 7 of 11 — CVEs classified under CWE-266, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-5999 | High | 7.2 | 2025-08-01 | A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vau… |
CVE-2025-43260 | Medium | 5.1 | 2025-07-30 | This issue was addressed with improved data protection. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. An app may be able to hijack entitlemen… |
CVE-2025-2179 | | 2025-07-29 | An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on Linux devices enables a locally authenticated non administrativ… | |
CVE-2025-8261 | High | 7.3 | 2025-07-28 | A weakness has been identified in Vaelsys VaelsysV4 4.1.0. This vulnerability affects unknown code of the file /grid/vgrid_server.php of the component User Cre… |
CVE-2025-8181 | High | 7.2 | 2025-07-26 | A vulnerability, which was classified as critical, was found in TOTOLINK N600R and X2000R 1.0.0.1. This affects an unknown part of the file vsftpd.conf of the… |
CVE-2025-31513 | Medium | 6.5 | 2025-07-22 | An issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can elevate to administrator privileges via the IsAdminApprover parameter in a Request%20… |
CVE-2025-7947 | Medium | 5.4 | 2025-07-22 | A vulnerability classified as critical has been found in jshERP up to 3.5. Affected is an unknown function of the file /user/delete of the component Account Ha… |
CVE-2025-44655 | Critical | 9.8 | 2025-07-21 | In TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, the chroot_local_user option is enabled in the vsftpd.conf. This could lead to unauthorized access to syst… |
CVE-2025-52836 | Critical | 9.8 | 2025-07-16 | Incorrect Privilege Assignment vulnerability in Unity Business Technology Pty Ltd The E-Commerce ERP profitori allows Privilege Escalation.This issue affects T… |
CVE-2025-34112 | | 2025-07-15 | An authenticated multi-stage remote code execution vulnerability exists in Riverbed SteelCentral NetProfiler and NetExpress 10.8.7 virtual appliances. A SQL in… | |
CVE-2025-7576 | High | 7.3 | 2025-07-14 | A vulnerability was found in Teledyne FLIR FB-Series O and FLIR FH-Series ID 1.3.2.16 and classified as critical. Affected by this issue is some unknown functi… |
CVE-2025-7552 | Medium | 6.3 | 2025-07-14 | A vulnerability was found in Dromara Northstar up to 7.3.5. It has been rated as critical. Affected by this issue is the function preHandle of the file northst… |
CVE-2025-0140 | | 2025-07-09 | An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a locally authenticated non administrativ… | |
CVE-2025-0139 | | 2025-07-09 | An incorrect privilege assignment vulnerability in Palo Alto Networks Autonomous Digital Experience Manager allows a locally authenticated low privileged user… | |
CVE-2025-27028 | Medium | 6.8 | 2025-07-09 | The Linux deprivileged user vpuser in Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) can read the entire file system content, including files belonging t… |
CVE-2025-47422 | High | 7.5 | 2025-07-08 | Advanced Installer before 22.6 has an uncontrolled search path element local privilege escalation vulnerability. When running as SYSTEM in certain configuratio… |
CVE-2025-43001 | Medium | 6.9 | 2025-07-08 | SAPCAR allows an attacker logged in with high privileges to override the permissions of the current and parent directories of the user or process extracting th… |
CVE-2025-42992 | Medium | 6.9 | 2025-07-08 | SAPCAR allows an attacker logged in with high privileges to create a malicious SAR archive in SAPCAR. This could enable the attacker to exploit critical files… |
CVE-2025-7076 | Medium | 5.4 | 2025-07-06 | A vulnerability was found in BlackVue Dashcam 590X up to 20250624. It has been rated as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2025-49867 | Critical | 9.8 | 2025-07-04 | Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes realhomes allows Privilege Escalation.This issue affects RealHomes: from n/a through <=… |
CVE-2025-23970 | Critical | 9.8 | 2025-07-04 | Incorrect Privilege Assignment vulnerability in aonetheme Service Finder Booking sf-booking allows Privilege Escalation.This issue affects Service Finder Booki… |
CVE-2025-27021 | High | 7.0 | 2025-07-02 | The misconfiguration in the sudoers configuration of the operating system in Infinera G42 version R6.1.3 allows low privileged OS users to read/write physica… |
CVE-2025-45006 | Critical | 9.1 | 2025-07-01 | Improper mstatus.SUM bit retention (non-zero) in Open-Source RISC-V Processor commit f517abb violates privileged spec constraints, enabling potential physical… |
CVE-2025-6765 | Medium | 6.3 | 2025-06-27 | A vulnerability, which was classified as critical, has been found in Intelbras InControl 2.21.60.9. This issue affects some unknown processing of the file /v1/… |
CVE-2025-52726 | High | 8.6 | 2025-06-27 | Incorrect Privilege Assignment vulnerability in pebas CouponXxL Custom Post Types couponxxl-cpt allows Privilege Escalation.This issue affects CouponXxL Custom… |
CVE-2025-6736 | Medium | 6.3 | 2025-06-27 | A vulnerability classified as critical was found in juzaweb CMS 3.4.2. Affected by this vulnerability is an unknown functionality of the file /admin-cp/theme/i… |
CVE-2025-6735 | Medium | 6.3 | 2025-06-27 | A vulnerability classified as critical has been found in juzaweb CMS 3.4.2. Affected is an unknown function of the file /admin-cp/imports of the component Impo… |
CVE-2025-6702 | Medium | 4.3 | 2025-06-26 | A vulnerability, which was classified as problematic, was found in linlinjava litemall 1.8.0. Affected is an unknown function of the file /wx/comment/post. The… |
CVE-2025-41255 | High | 8.0 | 2025-06-25 | Cyberduck and Mountain Duck improperly handle TLS certificate pinning for untrusted certificates (e.g., self-signed), unnecessarily installing it to the Window… |
CVE-2025-23260 | Medium | 5.0 | 2025-06-24 | NVIDIA AIStore contains a vulnerability in the AIS Operator where a user may gain elevated k8s cluster access by using the ServiceAccount attached to the Clust… |
CVE-2025-6532 | Medium | 4.3 | 2025-06-24 | A vulnerability classified as problematic was found in NOYAFA/Xiami LF9 Pro up to 20250611. Affected by this vulnerability is an unknown functionality of the c… |
CVE-2025-6531 | Medium | 4.3 | 2025-06-24 | A vulnerability was found in SIFUSM/MZZYG BD S1 up to 20250611. It has been declared as problematic. This vulnerability affects unknown code of the component R… |
CVE-2025-6527 | Low | 3.1 | 2025-06-23 | A vulnerability, which was classified as problematic, was found in 70mai M300 up to 20250611. Affected is an unknown function of the component Web Server. The… |
CVE-2025-6525 | Medium | 4.3 | 2025-06-23 | A vulnerability classified as problematic was found in 70mai 1S up to 20250611. This vulnerability affects unknown code of the file /cgi-bin/Config.cgi?action=… |
CVE-2025-6099 | Medium | 5.3 | 2025-06-16 | A vulnerability was found in szluyu99 gin-vue-blog up to 61dd11ccd296e8642a318ada3ef7b3f7776d2410. It has been declared as critical. This vulnerability affects… |
CVE-2025-49580 | High | 8.0 | 2025-06-13 | XWiki is a generic wiki platform. From 8.2 and 7.4.5 until 17.1.0-rc-1, 16.10.4, and 16.4.7, pages can gain script or programming rights when they contain a li… |
CVE-2025-4228 | | 2025-06-13 | An incorrect privilege assignment vulnerability in Palo Alto Networks Cortex® XDR Broker VM allows an authenticated administrative user to execute certain file… | |
CVE-2025-4922 | High | 8.1 | 2025-06-11 | Nomad Community and Nomad Enterprise (“Nomad”) prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identif… |
CVE-2025-48129 | Critical | 9.8 | 2025-06-09 | Incorrect Privilege Assignment vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-… |
CVE-2025-47561 | High | 8.8 | 2025-06-09 | Incorrect Privilege Assignment vulnerability in RomanCode MapSVG mapsvg allows Privilege Escalation.This issue affects MapSVG: from n/a through < 8.6.13. |
CVE-2025-23974 | High | 8.1 | 2025-06-09 | Incorrect Privilege Assignment vulnerability in ifkooo One-Login one-login allows Privilege Escalation.This issue affects One-Login: from n/a through <= 1.4. |
CVE-2025-5791 | High | 7.1 | 2025-06-06 | A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than… |
CVE-2025-48911 | High | 8.2 | 2025-06-06 | Vulnerability of improper permission assignment in the note sharing module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-5649 | Medium | 5.3 | 2025-06-05 | A vulnerability classified as critical has been found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file /admin/c… |
CVE-2025-46204 | Medium | 6.5 | 2025-06-04 | An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /course/edit/{id} endpoint. |
CVE-2025-46203 | Medium | 6.5 | 2025-06-04 | An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /students/edit/{id} endpoint. |
CVE-2025-5522 | High | 7.3 | 2025-06-03 | A vulnerability was found in jack0240 魏 bskms 蓝天幼儿园管理系统 up to dffe6640b5b54d8e29da6f060e0493fea74b3fad. It has been rated as critical. Affected by this issue i… |
CVE-2025-5511 | Medium | 5.3 | 2025-06-03 | A vulnerability, which was classified as critical, has been found in quequnlong shiyi-blog up to 1.2.1. This issue affects some unknown processing of the file… |
CVE-2025-5429 | Medium | 6.3 | 2025-06-02 | A vulnerability classified as critical was found in juzaweb CMS up to 3.4.2. This vulnerability affects unknown code of the file /admin-cp/plugin/install of th… |
CVE-2025-5428 | Medium | 6.3 | 2025-06-02 | A vulnerability classified as critical has been found in juzaweb CMS up to 3.4.2. This affects an unknown part of the file /admin-cp/log-viewer of the componen… |
CVE-2025-5427 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in juzaweb CMS up to 3.4.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin-cp… |
CVE-2025-5426 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in juzaweb CMS up to 3.4.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2025-5425 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in juzaweb CMS up to 3.4.2. It has been classified as critical. Affected is an unknown function of the file /admin-cp/theme/editor/de… |
CVE-2025-5424 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in juzaweb CMS up to 3.4.2 and classified as critical. This issue affects some unknown processing of the file /admin-cp/media of the… |
CVE-2025-5423 | Medium | 6.3 | 2025-06-02 | A vulnerability has been found in juzaweb CMS up to 3.4.2 and classified as critical. This vulnerability affects unknown code of the file /admin-cp/setting/sys… |
CVE-2025-5422 | Medium | 4.3 | 2025-06-02 | A vulnerability, which was classified as problematic, was found in juzaweb CMS up to 3.4.2. This affects an unknown part of the file /admin-cp/logs/email of th… |
CVE-2025-5421 | Medium | 6.3 | 2025-06-02 | A vulnerability, which was classified as critical, has been found in juzaweb CMS up to 3.4.2. Affected by this issue is some unknown functionality of the file… |
CVE-2025-5409 | High | 7.3 | 2025-06-01 | A vulnerability was found in Mist Community Edition up to 4.7.1. It has been classified as critical. This affects the function create_token of the file src/mis… |
CVE-2025-5390 | Medium | 6.3 | 2025-05-31 | A vulnerability, which was classified as critical, was found in JeeWMS up to 20250504. This affects the function filedeal of the file /systemController/filedea… |
CVE-2025-5389 | Medium | 6.3 | 2025-05-31 | A vulnerability, which was classified as critical, has been found in JeeWMS up to 20250504. Affected by this issue is the function dogenerateOne2Many of the fi… |
CVE-2025-5387 | Medium | 6.3 | 2025-05-31 | A vulnerability classified as critical has been found in JeeWMS up to 20250504. Affected is the function dogenerate of the file /generateController.do?dogenera… |
CVE-2025-4493 | Medium | 6.5 | 2025-05-28 | Improper privilege assignment in PAM JIT privilege sets in Devolutions Server allows a PAM user to perform PAM JIT requests on unauthorized groups by exploit… |
CVE-2025-5175 | Medium | 5.3 | 2025-05-26 | A vulnerability was found in erdogant pypickle up to 1.1.5. It has been classified as critical. This affects the function Save of the file pypickle/pypickle.py… |
CVE-2025-5163 | Medium | 5.3 | 2025-05-26 | A vulnerability, which was classified as problematic, was found in yangshare 技术杨工 warehouseManager 仓库管理系统 1.0. This affects an unknown part. The manipulation l… |
CVE-2025-48741 | | 2025-05-23 | A Broken Access Control vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, and 5.4.0 before 5.4.10 allows remote, authenticated, and… | |
CVE-2025-47631 | High | 8.8 | 2025-05-23 | Incorrect Privilege Assignment vulnerability in mojoomla Hospital Management System allows Privilege Escalation. This issue affects Hospital Management System… |
CVE-2025-47539 | Critical | 9.8 | 2025-05-23 | Incorrect Privilege Assignment vulnerability in Arraytics Eventin wp-event-solution allows Privilege Escalation.This issue affects Eventin: from n/a through <=… |
CVE-2025-39489 | Critical | 9.8 | 2025-05-23 | Incorrect Privilege Assignment vulnerability in pebas CouponXL couponxl allows Privilege Escalation.This issue affects CouponXL: from n/a through <= 4.5.0. |
CVE-2025-31918 | Critical | 9.8 | 2025-05-23 | Incorrect Privilege Assignment vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows Privilege Escalation.This issue… |
CVE-2025-48695 | Medium | 6.4 | 2025-05-23 | An issue was discovered in CyberDAVA before 1.1.20. A privilege escalation vulnerability allows a low-privileged user to escalate their privilege by abusing th… |
CVE-2025-4692 | Medium | 6.8 | 2025-05-23 | Actors can use a maliciously crafted JavaScript object notation (JSON) web token (JWT) to perform privilege escalation by submitting the malicious JWT to a vul… |
CVE-2025-47291 | High | 7.5 | 2025-05-21 | containerd is an open-source container runtime. A bug was found in the containerd's CRI implementation where containerd, starting in version 2.0.1 and prior to… |
CVE-2025-39366 | High | 8.8 | 2025-05-19 | Incorrect Privilege Assignment vulnerability in Rocket Apps wProject.This issue affects wProject: from n/a before 5.8.0. |
CVE-2025-39459 | High | 7.3 | 2025-05-19 | Incorrect Privilege Assignment vulnerability in contempoinc Real Estate 7 realestate-7 allows Privilege Escalation.This issue affects Real Estate 7: from n/a t… |
CVE-2025-39405 | High | 8.8 | 2025-05-19 | Incorrect Privilege Assignment vulnerability in mojoomla WPAMS apartment-management allows Privilege Escalation.This issue affects WPAMS: from n/a through <= 4… |
CVE-2025-4819 | Low | 3.1 | 2025-05-17 | A vulnerability classified as problematic has been found in y_project RuoYi 4.8.0. Affected is an unknown function of the file /monitor/online/batchForceLogout… |
CVE-2025-0135 | Low | 3.3 | 2025-05-14 | An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a locally authenticated non administrativ… |
CVE-2025-0131 | | 2025-05-14 | An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows d… | |
CVE-2025-3744 | High | 7.6 | 2025-05-13 | Nomad Enterprise (“Nomad”) jobs using the policy override option are bypassing the mandatory sentinel policies. This vulnerability, identified as CVE-2025-3744… |
CVE-2025-40571 | Low | 2.2 | 2025-05-13 | A vulnerability has been identified in Mendix OIDC SSO (Mendix 10.12 compatible) (All versions < V4.0.1), Mendix OIDC SSO (Mendix 9 compatible) (All versions <… |
CVE-2025-4374 | Medium | 6.5 | 2025-05-06 | A flaw was found in Quay. When an organization acts as a proxy cache, and a user or robot pulls an image that hasn't been mirrored yet, they are granted "Admin… |
CVE-2025-2898 | High | 7.5 | 2025-05-06 | IBM Maximo Application Suite 9.0 could allow an attacker with some level of access to elevate their privileges due to a security configuration vulnerability in… |
CVE-2025-4269 | Medium | 6.5 | 2025-05-05 | A vulnerability was found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/cstecgi.cgi… |
CVE-2025-3517 | Medium | 6.3 | 2025-05-01 | Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a previously configured u… |
CVE-2025-27007 | Critical | 9.8 | 2025-05-01 | Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through… |
CVE-2025-4136 | Medium | 5.4 | 2025-04-30 | A vulnerability was found in Weitong Mall 1.0.0. It has been classified as critical. This affects an unknown part of the component Sale Endpoint. The manipulat… |
CVE-2025-4119 | Medium | 5.3 | 2025-04-30 | A vulnerability classified as critical was found in Weitong Mall 1.0.0. This vulnerability affects unknown code of the file /queryTotal of the component Produc… |
CVE-2025-4118 | Medium | 5.3 | 2025-04-30 | A vulnerability classified as critical has been found in Weitong Mall 1.0.0. This affects an unknown part of the file /historyList of the component Product His… |
CVE-2025-4067 | Medium | 5.3 | 2025-04-29 | A vulnerability classified as critical has been found in ScriptAndTools Online-Travling-System 1.0. Affected is an unknown function of the file /admin/viewpack… |
CVE-2025-4066 | High | 7.3 | 2025-04-29 | A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /… |
CVE-2025-4065 | High | 7.3 | 2025-04-29 | A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /… |
CVE-2025-4064 | Medium | 5.3 | 2025-04-29 | A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/vie… |
CVE-2025-4036 | Medium | 6.3 | 2025-04-28 | A vulnerability was found in 201206030 Novel 3.5.0 and classified as critical. This issue affects the function updateBookChapter of the file src/main/java/io/g… |
CVE-2025-4017 | Medium | 4.3 | 2025-04-28 | A vulnerability classified as problematic was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This vulnerability affects the funct… |
CVE-2025-4016 | Medium | 5.4 | 2025-04-28 | A vulnerability classified as critical has been found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This affects the function deleteIn… |
CVE-2025-3981 | Medium | 4.3 | 2025-04-27 | A vulnerability, which was classified as problematic, has been found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0. This issue affects some u… |
CVE-2025-3980 | Medium | 4.3 | 2025-04-27 | A vulnerability classified as problematic was found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0. This vulnerability affects unknown code of… |
CVE-2025-3977 | Medium | 4.3 | 2025-04-27 | A vulnerability was found in iteachyou Dreamer CMS up to 4.1.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2025-3967 | Medium | 5.4 | 2025-04-27 | A vulnerability was found in itwanger paicoding 1.0.3. It has been classified as critical. This affects an unknown part of the file /article/api/post of the co… |
CVE-2025-2850 | Low | 3.5 | 2025-04-26 | A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT180… |