CWE-269 · Improper Privilege Management (page 10)

Page 10 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.

All CVEs classified under CWE-269 — newest first (page 10 of 32)
CVESeverityScorePublishedSummary
CVE-2025-4315High8.82025-06-11The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.23. This…
CVE-2025-47849High8.82025-06-10A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can…
CVE-2025-47713High8.82025-06-10A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can…
CVE-2025-22829Medium4.32025-06-10The CloudStack Quota plugin has an improper privilege management logic in version 4.20.0.0. Anyone with authenticated user-account access in CloudStack 4.20.0…
CVE-2025-47955High7.82025-06-10Improper privilege management in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
CVE-2025-33067High8.42025-06-10Improper privilege management in Windows Kernel allows an unauthorized attacker to elevate privileges locally.
CVE-2025-22254Medium6.62025-06-10An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 thro…
CVE-2024-41797Medium4.32025-06-10A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.1), SCALANCE XC316-8 (6GK5324-8TS00-2AC2) (All versions < V3.1), S…
CVE-2025-46812025-06-10Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Abuse.This issue affects upKeeper Instant…
CVE-2025-4601High8.82025-06-10The "RH - Real Estate WordPress Theme" theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.0. This is due to th…
CVE-2025-27811High7.82025-06-04A local privilege escalation in the razer_elevation_service.exe in Razer Synapse 4 through 4.0.86.2502180127 allows a local attacker to escalate their privileg…
CVE-2025-26396High7.82025-06-02The SolarWinds Dameware Mini Remote Control was determined to be affected by Incorrect Permissions Local Privilege Escalation Vulnerability. This vulnerability…
CVE-2025-0358High8.82025-06-02During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed…
CVE-2025-4636High7.82025-05-30Due to excessive privileges granted to the web user running the airpointer web platform, a malicious actor that gains control of the this user would be able to…
CVE-2024-51392High8.82025-05-29An issue in OpenKnowledgeMaps Headstart v7 allows a remote attacker to escalate privileges via the url parameter of the getPDF.php component
CVE-2024-41199High7.22025-05-22An issue in Ocuco Innovation - JOBMANAGER.EXE v2.10.24.16 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP…
CVE-2024-40462High7.82025-05-22An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the SETTINGSVATIGATOR.EXE component
CVE-2024-40461High7.82025-05-22An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the STOCKORDERENTRY.EXE component
CVE-2024-40460High7.82025-05-22An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the JOBENTRY.EXE
CVE-2024-40459High7.82025-05-22An issue in Ocuco Innovation APPMANAGER.EXE v.2.10.24.51 allows a local attacker to escalate privileges via the application manager function
CVE-2024-40458High7.82025-05-22An issue in Ocuco Innovation Tracking.exe v.2.10.24.51 allows a local attacker to escalate privileges via the modification of TCP packets.
CVE-2025-44040High7.22025-05-21An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php and the checkForOldHash function. Authentication decisions may be mad…
CVE-2025-24183Medium5.52025-05-19The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. A local user may be able to…
CVE-2025-30475High8.12025-05-15Dell PowerScale InsightIQ, versions 5.0 through 5.2, contains an improper privilege management vulnerability. An unauthenticated attacker with remote access co…
CVE-2025-29976High7.82025-05-13Improper privilege management in Microsoft Office SharePoint allows an authorized attacker to elevate privileges locally.
CVE-2025-27468High7.02025-05-13Improper privilege management in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.
CVE-2025-31222High7.82025-05-12A correctness issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura…
CVE-2025-24258High7.82025-05-12A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app ma…
CVE-2025-0505Critical10.02025-05-08On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision sys…
CVE-2024-8100High8.72025-05-08On affected versions of the Arista CloudVision Portal (CVP on-prem), the time-bound device onboarding token can be used to gain admin privileges on CloudVision.
CVE-2025-4335High8.82025-05-07The Woocommerce Multiple Addresses plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.7.1. This is due to ins…
CVE-2025-3852High8.82025-05-07The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.0 to 2.6.0. This is due to the plugin…
CVE-2025-474202025-05-06266 vulnerability in Crestron Automate VX allows Privilege Escalation.This issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.
CVE-2025-3438Medium6.52025-05-02The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and in…
CVE-2025-32974Critical9.02025-04-30XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.8 and from 16.0.0-rc-1 to before 16.2.0, the required rights analysis doe…
CVE-2025-25962Critical9.82025-04-29An issue in Coresmartcontracts Uniswap v.3.0 and fixed in v.4.0 allows a remote attacker to escalate privileges via the _modifyPosition function
CVE-2025-4085High7.12025-04-29An attacker with control over a content process could potentially leverage the privileged UITour actor to leak sensitive information or escalate privileges. Th…
CVE-2025-3224High7.82025-04-28A vulnerability in the update process of Docker Desktop for Windows versions prior to 4.41.0 could allow a local, low-privileged attacker to escalate privilege…
CVE-2025-46576Medium5.42025-04-27There is a Permission Management and Access Control vulnerability in the GoldenDB database product. Attackers can manipulate requests to bypass privilege restr…
CVE-2025-2238High8.82025-04-25The Vikinger theme for WordPress is vulnerable to privilege in all versions up to, and including, 1.9.30. This is due to insufficient user_meta restrictions in…
CVE-2025-3101High8.82025-04-24The Configurator Theme Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.4.7. This is due to the plugin n…
CVE-2025-3761High8.82025-04-24The My Tickets – Accessible Event Ticketing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.16. This is du…
CVE-2025-1732Medium6.72025-04-22An improper privilege management vulnerability in the recovery function of the Zyxel USG FLEX H series uOS firmware version V1.31 and earlier could allow an au…
CVE-2025-32955Medium6.02025-04-21Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Versions from 0.12.0 to before 2.12.0 are vulnerable to `disable-sud…
CVE-2025-3278Critical9.82025-04-19The UrbanGo Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.0.4. This is due to the plugin allowing u…
CVE-2025-28237High8.82025-04-18An issue in WorldCast Systems ECRESO FM/DAB/TV Transmitter v1.10.1 allows authenticated attackers to escalate privileges via a crafted JSON payload.
CVE-2025-25230High7.82025-04-16Omnissa Horizon Client for Windows contains an LPE Vulnerability. A malicious actor with local access where Horizon Client for Windows is installed may be able…
CVE-2024-22036Critical9.12025-04-16A vulnerability has been identified within Rancher where a cluster or node driver can be used to escape the chroot jail and gain root access to the Rancher co…
CVE-2023-32197Medium6.62025-04-16A Improper Privilege Management vulnerability in SUSE rancher in RoleTemplateobjects when external=true is set can lead to privilege escalation in specific sce…
CVE-2025-28399Critical9.82025-04-15An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class.
CVE-2025-3418High8.82025-04-12The WPC Admin Columns plugin for WordPress is vulnerable to privilege escalation in versions 2.0.6 to 2.1.0. This is due to the plugin not properly restricting…
CVE-2023-41076High7.32025-04-11An app may be able to elevate privileges. This issue is fixed in macOS 14. This issue was addressed by removing the vulnerable code.
CVE-2023-38614Medium4.32025-04-11A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to access sens…
CVE-2025-29800High7.82025-04-08Improper privilege management in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally.
CVE-2025-29999Medium6.72025-04-08A vulnerability has been identified in Siemens License Server (SLS) (All versions < V4.3). The affected application searches for executable files in the applic…
CVE-2025-28401Medium6.72025-04-07An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the menuId parameter
CVE-2025-28400Medium6.72025-04-07An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the postID parameter in the edit method
CVE-2025-2798Critical9.82025-04-04The Woffice CRM theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.21. This is due to a misconfiguration of e…
CVE-2025-3105High8.82025-04-04The Vehica Core plugin for WordPress, used by the Vehica - Car Dealer & Listing WordPress Theme, is vulnerable to privilege escalation in all versions up to, a…
CVE-2025-31286Medium4.62025-04-02An HTML injection vulnerability previously discovered in Trend Vision One could have allowed a malicious user to execute arbitrary code. Please note: this i…
CVE-2025-31285Medium4.62025-04-02A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allowed an administrator to create users who…
CVE-2025-31284Medium4.62025-04-02A broken access control vulnerability previously discovered in the Trend Vision One Status component could have allowed an administrator to create users who co…
CVE-2025-31283Medium4.62025-04-02A broken access control vulnerability previously discovered in the Trend Vision One User Roles component could have allowed an administrator to create users wh…
CVE-2025-31282Medium4.62025-04-02A broken access control vulnerability previously discovered in the Trend Vision One User Account component could have allowed an administrator to create users…
CVE-2025-29033High7.32025-04-01An issue in BambooHR Build v.25.0210.170831-83b08dd allows a remote attacker to escalate privileges via the /saml/index.php?r=" HTTP GET parameter.
CVE-2025-22231High7.82025-04-01VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can escalate their privilege…
CVE-2025-2237Critical9.82025-04-01The WP RealEstate plugin for WordPress, used by the Homeo theme, is vulnerable to privilege escalation in all versions up to, and including, 1.6.26. This is du…
CVE-2025-04162025-04-01Local privilege escalation through insecure DCOM configuration in Valmet DNA versions prior to C2023. The DCOM object Valmet DNA Engineering has permissions th…
CVE-2025-24254High8.82025-03-31This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A user may…
CVE-2025-22937Critical9.82025-03-31An issue in Adtran 411 ONT vL80.00.0011.M2 allows attackers to escalate privileges via unspecified vectors.
CVE-2025-2858High8.82025-03-28Privilege escalation vulnerability in the saTECH BCU firmware version 2.1.3. An attacker with access to the CLI of the device could make use of the nice comman…
CVE-2024-58104High7.32025-03-25A vulnerability in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker to bypass existing security and execute…
CVE-2022-1804Medium5.52025-03-25accountsservice no longer drops permissions when writting .pam_environment
CVE-2024-53350High7.42025-03-21Insecure permissions in kubeslice v1.3.1 allow attackers to gain access to the service account's token, leading to escalation of privileges.
CVE-2024-53349High7.42025-03-21Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account's token, leading to escalation of privileges via the secretes co…
CVE-2025-29924High7.52025-03-19XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, it's possible for an user to get access to private information through…
CVE-2025-2324Medium5.92025-03-19Improper Privilege Management vulnerability for users configured as Shared Accounts in Progress MOVEit Transfer (SFTP module) allows Privilege Escalation.This…
CVE-2024-48828Medium5.52025-03-17Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Privilege Management vulnerability. A low privileged…
CVE-2025-25872Medium5.52025-03-14An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function
CVE-2025-2232Critical9.82025-03-14The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all versions up to, an…
CVE-2024-13376High8.82025-03-14The Industrial theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check o…
CVE-2024-57062Medium6.72025-03-13An issue in SoundCloud IOS application v.7.65.2 allows a local attacker to escalate privileges and obtain sensitive information via the session handling compon…
CVE-2025-21199Medium6.72025-03-11Improper privilege management in Azure Agent Installer allows an authorized attacker to elevate privileges locally.
CVE-2025-26706Medium5.42025-03-11Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.07.
CVE-2025-26705Medium5.32025-03-11Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.
CVE-2025-26704Medium6.42025-03-11Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.
CVE-2025-26703Medium4.32025-03-11Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.04.
CVE-2025-26707Medium5.32025-03-11Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.
CVE-2024-54560Medium5.52025-03-10A logic issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, watchOS 11. A malicious app may be ab…
CVE-2025-0177Critical9.82025-03-08The Javo Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.0.0.080. This is due to the plugin allowing us…
CVE-2024-13835High7.22025-03-08The Post Meta Data Manager plugin for WordPress is vulnerable to multisite privilege escalation in all versions up to, and including, 1.4.4. This is due to the…
CVE-2025-1121Medium6.82025-03-07Privilege escalation in Installer and Recovery image handling in Google ChromeOS version 15786.48.2 on device allows an attacker with physical access to gain r…
CVE-2024-12281Critical9.82025-03-05The Homey theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.2. This is due to the plugin allowing users who a…
CVE-2024-11951Critical9.82025-03-05The Homey Login Register plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.0. This is due to the plugin allo…
CVE-2025-27644High7.82025-03-05Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Local Privilege Escalation V-2024-007.
CVE-2025-27639High8.82025-03-05Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Privilege Escalation V-2024-015.
CVE-2025-14252025-03-04A Sudo privilege misconfiguration vulnerability in PocketBook InkPad Color 3 on Linux, ARM allows attackers to read file contents on the device.This issue affe…
CVE-2025-14242025-03-04A privilege escalation vulnerability in PocketBook InkPad Color 3 allows attackers to escalate to root privileges if they gain physical access to the device. T…
CVE-2024-24778Medium6.52025-03-03Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. This issue affec…
CVE-2024-8420Critical9.82025-02-28The DHVC Form plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.7. This is due to the plugin allowing a user…