CWE-266 · Incorrect Privilege Assignment (page 9)
Page 9 of 11 — CVEs classified under CWE-266, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-57967 | Medium | 4.2 | 2025-02-03 | PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 has potentially elevated privileges in LDAP mapping. |
CVE-2024-43333 | High | 7.5 | 2025-02-03 | Incorrect Privilege Assignment vulnerability in NotFound Admin and Site Enhancements (ASE) Pro allows Privilege Escalation. This issue affects Admin and Site E… |
CVE-2024-46974 | High | 7.8 | 2025-01-31 | Software installed and run as a non-privileged user may conduct improper read/write operations on imported/exported DMA buffers. |
CVE-2025-0849 | Medium | 6.3 | 2025-01-30 | A vulnerability classified as critical has been found in CampCodes School Management Software 1.0. Affected is an unknown function of the file /edit-staff/ of… |
CVE-2025-0802 | High | 7.3 | 2025-01-29 | A vulnerability classified as critical was found in SourceCodester Best Employee Management System 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2025-0797 | Low | 3.3 | 2025-01-29 | A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been declared as problematic. This vulnerability affects unknown code of the fi… |
CVE-2025-0783 | Medium | 6.3 | 2025-01-28 | A vulnerability, which was classified as problematic, was found in pankajindevops scale up to 20241113. This affects an unknown part of the component API Endpo… |
CVE-2024-35122 | Low | 2.8 | 2025-01-24 | IBM i 7.2, 7.3, 7.4, and 7.5 is vulnerable to a file level local denial of service caused by an insufficient authority requirement. A local non-privileged user… |
CVE-2024-51888 | Critical | 9.8 | 2025-01-21 | Incorrect Privilege Assignment vulnerability in favethemes Homey Login Register homey-login-register allows Privilege Escalation.This issue affects Homey Login… |
CVE-2024-32555 | Critical | 9.8 | 2025-01-21 | Incorrect Privilege Assignment vulnerability in InspiryThemes Easy Real Estate easy-real-estate allows Privilege Escalation.This issue affects Easy Real Estate… |
CVE-2025-23528 | High | 8.8 | 2025-01-16 | Incorrect Privilege Assignment vulnerability in Mosterd3d DD Roles dd-roles allows Privilege Escalation.This issue affects DD Roles: from n/a through <= 4.1. |
CVE-2024-45331 | High | 7.3 | 2025-01-16 | A incorrect privilege assignment vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 all versions… |
CVE-2025-0484 | High | 7.3 | 2025-01-15 | A vulnerability was found in Fanli2012 native-php-cms 1.0 and classified as critical. This issue affects some unknown processing of the file /fladmin/sysconfig… |
CVE-2025-22736 | High | 8.8 | 2025-01-15 | Incorrect Privilege Assignment vulnerability in Saad Iqbal User Management user-management allows Privilege Escalation.This issue affects User Management: from… |
CVE-2024-33503 | Medium | 6.7 | 2025-01-14 | A improper privilege management vulnerability in Fortinet FortiManager Cloud 7.4.1 through 7.4.3, FortiManager Cloud 7.2.1 through 7.2.5, FortiManager Cloud 7… |
CVE-2024-13251 | High | 8.8 | 2025-01-09 | Incorrect Privilege Assignment vulnerability in Drupal Registration role allows Privilege Escalation.This issue affects Registration role: from 0.0.0 before 2… |
CVE-2024-13248 | Medium | 5.5 | 2025-01-09 | Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 befor… |
CVE-2024-13211 | Medium | 6.3 | 2025-01-09 | A vulnerability was found in SingMR HouseRent 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file src/main/jav… |
CVE-2024-13206 | High | 7.8 | 2025-01-09 | A vulnerability classified as critical has been found in REVE Antivirus 1.0.0.0 on Linux. This affects an unknown part of the file /usr/local/reveantivirus/tmp… |
CVE-2024-13200 | High | 7.3 | 2025-01-09 | A vulnerability, which was classified as critical, was found in wander-chu SpringBoot-Blog 1.0. This affects the function preHandle of the file src/main/java/c… |
CVE-2024-13189 | High | 7.3 | 2025-01-08 | A vulnerability classified as critical has been found in ZeroWdd myblog 1.0. This affects an unknown part of the file src/main/java/com/wdd/myblog/config/MyBlo… |
CVE-2024-13188 | Medium | 5.3 | 2025-01-08 | A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been rated as critical. Affected by this issue is some unknown functionality of… |
CVE-2024-56280 | High | 8.8 | 2025-01-07 | Incorrect Privilege Assignment vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Privilege Escalation.This issue affects WPGuppy: from n/… |
CVE-2024-49644 | High | 8.8 | 2025-01-07 | Incorrect Privilege Assignment vulnerability in AllAccessible Accessibility by AllAccessible allaccessible allows Privilege Escalation.This issue affects Acces… |
CVE-2024-12470 | Critical | 9.8 | 2025-01-07 | The School Management System – SakolaWP plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.8. This is due to… |
CVE-2025-0206 | Medium | 5.3 | 2025-01-04 | A vulnerability classified as critical was found in code-projects Online Shoe Store 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2024-56513 | | 2025-01-03 | Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1… | |
CVE-2024-55542 | Medium | 4.4 | 2025-01-02 | Local privilege escalation due to excessive permissions assigned to Tray Monitor service. The following products are affected: Acronis Cyber Protect 16 (Linux… |
CVE-2024-13109 | Medium | 5.3 | 2025-01-02 | A vulnerability was found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. It has been rated as critical. This issue affects som… |
CVE-2024-13108 | Medium | 5.3 | 2025-01-02 | A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. It has been declared as critical. This vulnerability affects unknown code of the file /g… |
CVE-2024-13107 | Medium | 5.3 | 2025-01-02 | A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. It has been classified as critical. This affects an unknown part of the file /goform/for… |
CVE-2024-13106 | Medium | 5.3 | 2025-01-02 | A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210 and classified as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2024-13105 | Medium | 5.3 | 2025-01-02 | A vulnerability has been found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210 and classified as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2024-13104 | Medium | 5.3 | 2025-01-02 | A vulnerability, which was classified as critical, was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. Affected is an unknown function of the file /goform/f… |
CVE-2024-13103 | Medium | 5.3 | 2025-01-02 | A vulnerability, which was classified as critical, has been found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. This issue affects some unknown processing of th… |
CVE-2024-13102 | Medium | 5.3 | 2025-01-02 | A vulnerability classified as critical was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. This vulnerability affects unknown code of the file /goform/DDNS… |
CVE-2024-52049 | High | 7.8 | 2024-12-31 | A LogServer link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. This vulnerabil… |
CVE-2024-52048 | High | 7.8 | 2024-12-31 | A LogServer link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. This vulnerabil… |
CVE-2024-56043 | Critical | 9.8 | 2024-12-31 | Incorrect Privilege Assignment vulnerability in VibeThemes WPLMS wplms_plugin allows Privilege Escalation.This issue affects WPLMS: from n/a through <= 1.9.9. |
CVE-2024-56040 | Critical | 9.8 | 2024-12-31 | Incorrect Privilege Assignment vulnerability in VibeThemes VibeBP vibebp allows Privilege Escalation.This issue affects VibeBP: from n/a through <= 1.9.9.4.1. |
CVE-2024-56205 | Critical | 9.8 | 2024-12-31 | Incorrect Privilege Assignment vulnerability in SunnyKai AI Magic newsletter-page-redirects allows Privilege Escalation.This issue affects AI Magic: from n/a t… |
CVE-2024-56071 | Critical | 9.8 | 2024-12-31 | Incorrect Privilege Assignment vulnerability in mikeleembruggen Simple Dashboard simple-dashboard allows Privilege Escalation.This issue affects Simple Dashboa… |
CVE-2024-56220 | Critical | 9.8 | 2024-12-31 | Incorrect Privilege Assignment vulnerability in sslplugins SSL Wireless SMS Notification ssl-wireless-sms-notification allows Privilege Escalation.This issue a… |
CVE-2024-13067 | Medium | 5.3 | 2024-12-31 | A vulnerability was found in CodeAstro Online Food Ordering System 1.0 and classified as critical. This issue affects some unknown processing of the file /admi… |
CVE-2024-50702 | Medium | 5.4 | 2024-12-30 | TeamPass before 3.1.3.1 does not properly check whether a mail_me (aka action_mail) operation is on behalf of an administrator or manager. |
CVE-2024-50701 | Medium | 4.3 | 2024-12-30 | TeamPass before 3.1.3.1, when retrieving information about access rights for a folder, does not properly check whether a folder is in a user's allowed folders… |
CVE-2024-13030 | High | 7.3 | 2024-12-30 | A vulnerability was found in D-Link DIR-823G 1.0.2B05_20181207. It has been rated as critical. This issue affects the function SetAutoRebootSettings/SetClientI… |
CVE-2024-12901 | Medium | 5.3 | 2024-12-23 | A vulnerability classified as critical was found in FoxCMS up to 1.2. Affected by this vulnerability is an unknown functionality of the file /app/api/controlle… |
CVE-2024-12678 | Medium | 6.5 | 2024-12-20 | Nomad Community and Nomad Enterprise ("Nomad") allocations are vulnerable to privilege escalation within a namespace through unredacted workload identity token… |
CVE-2024-12786 | High | 7.8 | 2024-12-19 | A vulnerability, which was classified as critical, was found in X1a0He Adobe Downloader up to 1.3.1 on macOS. Affected is the function shouldAcceptNewConnectio… |
CVE-2024-12782 | High | 7.3 | 2024-12-19 | A vulnerability has been found in Fujifilm Business Innovation Apeos C3070, Apeos C5570 and Apeos C6580 up to 24.8.28 and classified as critical. This vulnerab… |
CVE-2024-54383 | Critical | 9.8 | 2024-12-18 | Incorrect Privilege Assignment vulnerability in wpweb WooCommerce PDF Vouchers woocommerce-pdf-vouchers allows Privilege Escalation.This issue affects WooComme… |
CVE-2024-9779 | High | 7.5 | 2024-12-17 | A flaw was found in Open Cluster Management (OCM) when a user has access to the worker nodes which contain the cluster-manager or klusterlet deployments. The c… |
CVE-2024-12666 | Medium | 4.7 | 2024-12-16 | A vulnerability has been found in ClassCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin?… |
CVE-2024-54229 | Critical | 9.8 | 2024-12-16 | Incorrect Privilege Assignment vulnerability in straightvisions GmbH SV100 Companion sv100-companion allows Privilege Escalation.This issue affects SV100 Compa… |
CVE-2024-54365 | High | 8.8 | 2024-12-16 | Incorrect Privilege Assignment vulnerability in Knowhalim KH Easy User Settings kh-easy-user-settings allows Privilege Escalation.This issue affects KH Easy Us… |
CVE-2024-54363 | Critical | 9.8 | 2024-12-16 | Incorrect Privilege Assignment vulnerability in saiful.total Wp NssUser Register wp-nssuser-register allows Privilege Escalation.This issue affects Wp NssUser… |
CVE-2024-54293 | Critical | 9.8 | 2024-12-13 | Incorrect Privilege Assignment vulnerability in CE21 CE21 Suite ce21-suite allows Privilege Escalation.This issue affects CE21 Suite: from n/a through <= 2.2.0. |
CVE-2024-12347 | Medium | 5.3 | 2024-12-09 | A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms up to 1.0.0 and classified as critical. This issue affects some unknown processing o… |
CVE-2024-12235 | Medium | 6.3 | 2024-12-05 | A vulnerability was found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 1.0.0. It has been declared as critical. Affected by this vulnerabil… |
CVE-2024-11860 | Medium | 6.5 | 2024-11-27 | A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. This affects an unknown part of the file /rent… |
CVE-2023-26280 | Medium | 5.3 | 2024-11-25 | IBM Jazz Foundation 7.0.2 and 7.0.3 could allow a user to change their dashboard using a specially crafted HTTP request due to improper access control. |
CVE-2024-11486 | Medium | 4.3 | 2024-11-20 | A vulnerability, which was classified as problematic, was found in Code4Berry Decoration Management System 1.0. This affects an unknown part of the file /decor… |
CVE-2024-11485 | Medium | 6.3 | 2024-11-20 | A vulnerability, which was classified as critical, has been found in Code4Berry Decoration Management System 1.0. Affected by this issue is some unknown functi… |
CVE-2024-11484 | Medium | 6.3 | 2024-11-20 | A vulnerability classified as critical was found in Code4Berry Decoration Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-9479 | | 2024-11-20 | Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue affects upKeeper Ins… | |
CVE-2024-9478 | | 2024-11-20 | Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue affects upKeeper Ins… | |
CVE-2024-52442 | Critical | 9.8 | 2024-11-20 | Incorrect Privilege Assignment vulnerability in userplus UserPlus userplus allows Privilege Escalation.This issue affects UserPlus: from n/a through <= 2.0. |
CVE-2024-11306 | Medium | 5.3 | 2024-11-18 | A vulnerability, which was classified as critical, has been found in Altenergy Power Control Software up to 20241108. This issue affects some unknown processin… |
CVE-2020-25720 | High | 7.5 | 2024-11-17 | A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the new… |
CVE-2024-10978 | Medium | 4.2 | 2024-11-14 | Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack require… |
CVE-2024-9476 | | 2024-11-13 | A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within… | |
CVE-2024-29119 | High | 7.8 | 2024-11-12 | A vulnerability has been identified in Spectrum Power 7 (All versions < V24Q3). The affected product contains several root-owned SUID binaries that could allow… |
CVE-2024-47595 | Medium | 6.3 | 2024-11-12 | An attacker who gains local membership to sapsys group could replace local files usually protected by privileged access. On successful exploitation the attacke… |
CVE-2024-11073 | Medium | 4.3 | 2024-11-11 | A vulnerability classified as problematic has been found in SourceCodester Hospital Management System 1.0. This affects an unknown part of the file /vm/patient… |
CVE-2024-45759 | Medium | 6.8 | 2024-11-08 | Dell PowerProtect Data Domain, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an escalation of privilege vulnerability. A local low pr… |
CVE-2024-10766 | Medium | 6.3 | 2024-11-04 | A vulnerability, which was classified as critical, has been found in Codezips Free Exam Hall Seating Management System 1.0. This issue affects some unknown pro… |
CVE-2024-10765 | Medium | 6.3 | 2024-11-04 | A vulnerability classified as critical was found in Codezips Online Institute Management System up to 1.0. This vulnerability affects unknown code of the file… |
CVE-2024-10764 | Medium | 6.3 | 2024-11-04 | A vulnerability classified as critical has been found in Codezips Online Institute Management System 1.0. This affects an unknown part of the file /pages/save_… |
CVE-2024-10654 | Medium | 5.3 | 2024-11-01 | A vulnerability has been found in TOTOLINK LR350 up to 9.3.5u.6369 and classified as critical. Affected by this vulnerability is an unknown functionality of th… |
CVE-2024-50506 | High | 8.8 | 2024-10-30 | Incorrect Privilege Assignment vulnerability in azexo Marketing Automation by AZEXO marketing-automation-by-azexo allows Privilege Escalation.This issue affect… |
CVE-2024-50504 | High | 8.8 | 2024-10-30 | Incorrect Privilege Assignment vulnerability in webxmedia Bulk Change Role bulk-role-change allows Privilege Escalation.This issue affects Bulk Change Role: fr… |
CVE-2024-50550 | High | 8.1 | 2024-10-29 | Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed… |
CVE-2024-50485 | Critical | 9.8 | 2024-10-29 | Incorrect Privilege Assignment vulnerability in Udit Rawat Exam Matrix exam-matrix allows Privilege Escalation.This issue affects Exam Matrix: from n/a through… |
CVE-2024-50481 | High | 8.8 | 2024-10-29 | Incorrect Privilege Assignment vulnerability in stackthemes Bstone Demo Importer bstone-demo-importer allows Privilege Escalation.This issue affects Bstone Dem… |
CVE-2024-47904 | High | 7.8 | 2024-10-23 | A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 on… |
CVE-2024-49608 | High | 8.8 | 2024-10-20 | Incorrect Privilege Assignment vulnerability in gerryworks GERRYWORKS Post by Mail gerryworks-post-by-mail allows Privilege Escalation.This issue affects GERRY… |
CVE-2024-49322 | Critical | 9.8 | 2024-10-17 | Incorrect Privilege Assignment vulnerability in CodePassenger Job Board Manager for WordPress jemployee allows Privilege Escalation.This issue affects Job Boar… |
CVE-2024-49219 | High | 8.8 | 2024-10-17 | Incorrect Privilege Assignment vulnerability in themexpo RS-Members rs-members allows Privilege Escalation.This issue affects RS-Members: from n/a through <= 1… |
CVE-2024-49217 | Critical | 9.8 | 2024-10-17 | Incorrect Privilege Assignment vulnerability in madiriaashish Adding drop down roles in registration user-drop-down-roles-in-registration allows Privilege Esca… |
CVE-2024-9863 | Critical | 9.8 | 2024-10-17 | The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.6.0 due to the ins… |
CVE-2024-9180 | High | 7.2 | 2024-10-10 | A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s r… |
CVE-2024-9519 | High | 7.2 | 2024-10-10 | The UserPlus plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'save_metabox_form' function in… |
CVE-2024-48941 | Medium | 5.4 | 2024-10-10 | The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to bypass 2FA by interacting with the /rest e… |
CVE-2024-47653 | Medium | 6.5 | 2024-10-04 | This vulnerability exists in Shilpi Client Dashboard due to lack of authorization for modification and cancellation requests through certain API endpoints. An… |
CVE-2024-25660 | Critical | 9.0 | 2024-10-01 | The WebDAV service in Infinera TNMS (Transcend Network Management System) 19.10.3 allows a low-privileged remote attacker to conduct unauthorized file operatio… |
CVE-2024-25632 | High | 8.6 | 2024-10-01 | eLabFTW is an open source electronic lab notebook for research labs. In the context of eLabFTW, an administrator is a user account with certain privileges to m… |
CVE-2024-46511 | High | 7.5 | 2024-09-30 | LoadZilla LLC LoadLogic v1.4.3 was discovered to contain insecure permissions vulnerability which allows a remote attacker to execute arbitrary code via the Lo… |
CVE-2024-46540 | Medium | 6.3 | 2024-09-30 | A remote code execution (RCE) vulnerability in the component /admin/store.php of Emlog Pro before v2.3.15 allows attackers to use remote file downloads and sel… |
CVE-2024-9082 | Medium | 6.3 | 2024-09-22 | A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the… |