CWE-269 · Improper Privilege Management (page 8)
Page 8 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-14252 | High | 7.8 | 2025-12-16 | An Improper Access Control vulnerability in Advantech SUSI driver (susi.sys) allows attackers to read/write arbitrary memory, I/O ports, and MSRs, resulting in… |
CVE-2025-43512 | High | 7.8 | 2025-12-12 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 2… |
CVE-2025-43320 | High | 7.8 | 2025-12-12 | The issue was addressed by adding additional logic. This issue is fixed in macOS Sequoia 15.7.3, macOS Tahoe 26. An app may be able to bypass launch constraint… |
CVE-2025-67727 | Critical | 9.8 | 2025-12-12 | Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js. In versions prior to 8.6.0-alpha.2, a GitHub CI workflow i… |
CVE-2025-13764 | Critical | 9.8 | 2025-12-11 | The WP CarDealer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.16. This is due to the 'WP_CarDealer_User… |
CVE-2025-12952 | | 2025-12-10 | A privilege escalation vulnerability exists in Google Cloud's Dialogflow CX. Dialogflow agent developers with Webhook editor permission are able to configure… | |
CVE-2025-12381 | High | 7.8 | 2025-12-09 | Improper Privilege Management vulnerability in AlgoSec Firewall Analyzer on Linux, 64 bit allows Privilege Escalation, Parameter Injection. A local user with… |
CVE-2025-66324 | High | 8.4 | 2025-12-08 | Input verification vulnerability in the compression and decompression module. Impact: Successful exploitation of this vulnerability may affect app data integri… |
CVE-2025-13292 | | 2025-12-06 | A vulnerability in Apigee-X allowed an attacker to gain unauthorized read and write access to Apigee Analytics (AX) data and access logs belonging to other Api… | |
CVE-2025-62686 | Medium | 6.2 | 2025-12-03 | A local privilege escalation vulnerability exists in the Plugin Alliance InstallationHelper service included with Plugin Alliance Installation Manager v1.4.0 o… |
CVE-2025-55076 | Medium | 6.2 | 2025-12-03 | A local privilege escalation vulnerability exists in the InstallationHelper service included with Plugin Alliance Installation Manager v1.4.0 for macOS. The se… |
CVE-2025-7044 | High | 7.7 | 2025-12-03 | An Improper Input Validation vulnerability exists in the user websocket handler of MAAS. An authenticated, unprivileged attacker can intercept a user.update we… |
CVE-2025-13542 | Critical | 9.8 | 2025-12-02 | The DesignThemes LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.4. This is due to the 'dtlms_register… |
CVE-2025-59705 | Medium | 6.8 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a Physically Proximate Attacker to Escalate Privileges by enabling the… |
CVE-2025-59697 | High | 7.2 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker to escalate privileges by editing the… |
CVE-2025-59693 | Critical | 9.8 | 2025-12-02 | The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allows a physically proximate attacker to ob… |
CVE-2025-13534 | Medium | 6.3 | 2025-12-02 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.2… |
CVE-2025-65621 | Medium | 5.4 | 2025-12-01 | Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enablin… |
CVE-2025-13787 | Medium | 5.4 | 2025-11-30 | A flaw has been found in ZenTao up to 21.7.6-8564. The affected element is the function file::delete of the file module/file/control.php of the component File… |
CVE-2025-59790 | Medium | 5.4 | 2025-11-28 | Improper Privilege Management vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from v2.9.0 through v2.13.0. Users are recommended to upgra… |
CVE-2025-13680 | High | 8.8 | 2025-11-27 | The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the plugin allowing a user to… |
CVE-2025-13675 | Critical | 9.8 | 2025-11-27 | The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the 'paypal-submit.php' file… |
CVE-2025-13540 | Critical | 9.8 | 2025-11-27 | The Tiare Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. This is due to the 'tiare_membership… |
CVE-2025-13538 | Critical | 9.8 | 2025-11-27 | The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.5. This is due to the 'findall_listing… |
CVE-2025-66314 | High | 7.5 | 2025-11-27 | Improper Privilege Management vulnerability in ZTE ElasticNet UME R32 on Linux allows Accessing Functionality Not Properly Constrained by ACLs.This issue affec… |
CVE-2025-66266 | | 2025-11-26 | The RupsMon.exe service executable in UPSilon 2000 has insecure permissions, allowing the 'Everyone' group Full Control. A local attacker can replace the execu… | |
CVE-2025-66265 | | 2025-11-26 | CMService.exe creates the C:\\usr directory and subdirectories with insecure permissions, granting write access to all authenticated users. This allows attacke… | |
CVE-2025-33188 | High | 8.0 | 2025-11-25 | NVIDIA DGX Spark GB10 contains a vulnerability in hardware resources where an attacker could tamper with hardware controls. A successful exploit of this vulner… |
CVE-2025-33187 | Critical | 9.3 | 2025-11-25 | NVIDIA DGX Spark GB10 contains a vulnerability in SROOT, where an attacker could use privileged access to gain access to SoC protected areas. A successful expl… |
CVE-2025-13559 | Critical | 9.8 | 2025-11-25 | The EduKart Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the 'edukart_pro_registe… |
CVE-2025-54821 | Low | 1.9 | 2025-11-18 | An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11, FortiOS 7.2 all v… |
CVE-2025-40548 | Critical | 9.1 | 2025-11-18 | A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code. This iss… |
CVE-2025-20346 | Medium | 4.3 | 2025-11-13 | A vulnerability in Cisco Catalyst Center could allow an authenticated, remote attacker to execute operations that should require Administrator privileges. The… |
CVE-2025-11923 | High | 8.8 | 2025-11-13 | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to privilege escalation. This is due to the plugin not prope… |
CVE-2025-59514 | High | 7.8 | 2025-11-11 | Improper privilege management in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-24863 | Medium | 6.5 | 2025-11-11 | Improper privilege management for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an information discl… |
CVE-2025-24838 | High | 8.8 | 2025-11-11 | Improper privilege management for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of pri… |
CVE-2025-24307 | Low | 2.0 | 2025-11-11 | Improper privilege management for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of pri… |
CVE-2025-11457 | Critical | 9.8 | 2025-11-11 | The EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce Plugin plugin for WordPress is vulnerable to Privilege Escalation in versions 0.9.0-beta2 t… |
CVE-2025-11168 | High | 8.8 | 2025-11-11 | The Mementor Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.5. This is due to plugin not properly ha… |
CVE-2025-64507 | High | 7.8 | 2025-11-10 | Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0 affects any Incus user in an environment where an unpri… |
CVE-2025-12726 | High | 7.5 | 2025-11-10 | Inappropriate implementation in Views in Google Chrome on Windows prior to 142.0.7444.137 allowed a remote attacker who had compromised the renderer process to… |
CVE-2025-12405 | | 2025-11-10 | An improper privilege management vulnerability was found in Looker Studio. It impacted all JDBC-based connectors. A Looker Studio user with report view access… | |
CVE-2025-64489 | High | 8.3 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0… |
CVE-2025-64436 | Medium | 5.3 | 2025-11-07 | KubeVirt is a virtual machine management add-on for Kubernetes. In 1.5.0 and earlier, the permissions granted to the virt-handler service account, such as the… |
CVE-2025-64338 | Critical | 9.0 | 2025-11-07 | ClipBucket v5 is an open source video sharing platform. In versions 5.5.2 - #156 and below, an authenticated regular user can create a photo collection whose C… |
CVE-2025-64336 | Medium | 5.4 | 2025-11-07 | ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage Photos feature is vulnerable to stored Cross-site Scriptin… |
CVE-2025-12485 | High | 8.8 | 2025-11-06 | Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by… |
CVE-2025-46364 | Critical | 9.1 | 2025-11-05 | Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user with known password can run CLI Escape Vulnerability to gain control o… |
CVE-2025-12683 | | 2025-11-04 | The service employed by Everything, running as SYSTEM, communicates with the lower privileged Everything GUI via a named pipe. The named pipe has a NULL DACL a… | |
CVE-2024-13997 | High | 7.2 | 2025-11-03 | Nagios XI versions prior to 2024R1.1.3 contain a privilege escalation vulnerability in which an authenticated administrator could leverage the Migrate Server f… |
CVE-2025-8900 | Critical | 9.8 | 2025-11-03 | The Doccure Core plugin for WordPress is vulnerable to privilege escalation in versions up to, and excluding, 1.5.4. This is due to the plugin allowing users w… |
CVE-2025-8489 | Critical | 9.8 | 2025-10-31 | The King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor plugin for WordPress is vulnerable to privilege escalation in ver… |
CVE-2025-48982 | High | 7.8 | 2025-10-31 | This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation if a system administrator is tricked into restoring a malicious f… |
CVE-2024-14009 | High | 7.2 | 2025-10-30 | Nagios XI versions prior to 2024R1.0.1 contain a privilege escalation vulnerability in the System Profile component. The System Profile feature is an administr… |
CVE-2024-14004 | High | 8.8 | 2025-10-30 | Nagios XI versions prior to 2024R1.2 contain a privilege escalation vulnerability related to NagVis configuration handling (nagvis.conf). An authenticated user… |
CVE-2025-61429 | High | 8.8 | 2025-10-29 | An issue in NCR Atleos Terminal Manager (ConfigApp) v3.4.0 allows attackers to escalate privileges via a crafted request. |
CVE-2025-12425 | High | 7.8 | 2025-10-28 | Local Privilege Escalation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |
CVE-2025-12424 | Critical | 9.8 | 2025-10-28 | Privilege Escalation through SUID-bit Binary.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |
CVE-2025-1037 | | 2025-10-28 | By making minor configuration changes to the TropOS 4th Gen device, an authenticated user with the ability to run user level shell commands can enable access v… | |
CVE-2021-43768 | Medium | 5.3 | 2025-10-24 | In Malwarebytes For Teams v.1.0.990 and before and fixed in v.1.0.1003 and later a privilege escalation can occur via the COM interface running in mbamservice… |
CVE-2025-11086 | High | 8.1 | 2025-10-22 | The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation in all versions up to, and in… |
CVE-2025-62592 | Medium | 6.0 | 2025-10-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Easi… |
CVE-2025-61759 | Medium | 6.5 | 2025-10-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Easi… |
CVE-2025-5496 | Low | 3.3 | 2025-10-21 | ZohoCorp ManageEngine Endpoint Central versions earlier than 11.4.2508.14, 11.4.2516.06, and 11.4.2518.01 are affected by an arbitrary file deletion vulnerabil… |
CVE-2025-7851 | Critical | 9.8 | 2025-10-21 | An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways. |
CVE-2025-6042 | High | 7.3 | 2025-10-15 | The Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme plugin for WordPress is vulnerable to privilege escalation in all versions… |
CVE-2025-56747 | Medium | 6.5 | 2025-10-14 | Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_instructor controller where regular authenticated us… |
CVE-2025-9068 | High | 7.8 | 2025-10-14 | A security issue exists within the Rockwell Automation Driver Package x64 Microsoft Installer File (MSI) repair functionality, installed with FTLinx. Authentic… |
CVE-2025-9067 | High | 7.8 | 2025-10-14 | A security issue exists within the x86 Microsoft Installer File (MSI), installed with FTLinx. Authenticated attackers with valid Windows user credentials can i… |
CVE-2025-11533 | Critical | 9.8 | 2025-10-11 | The WP Freeio plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.21. This is due to the process_register() fu… |
CVE-2025-61152 | Medium | 6.5 | 2025-10-10 | python-jose thru 3.3.0 allows JWT tokens with 'alg=none' to be decoded and accepted without any cryptographic signature verification. A malicious actor can cra… |
CVE-2025-59247 | High | 8.8 | 2025-10-09 | Azure PlayFab Elevation of Privilege Vulnerability |
CVE-2025-11561 | High | 8.8 | 2025-10-09 | A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerbero… |
CVE-2025-61786 | Low | 3.3 | 2025-10-08 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.stat` and `Deno.FsFile.prototype.statS… |
CVE-2025-34251 | | 2025-10-07 | Tesla Telematics Control Unit (TCU) firmware prior to v2025.14 contains an authentication bypass vulnerability. The TCU runs the Android Debug Bridge (adbd) as… | |
CVE-2025-57443 | Medium | 5.1 | 2025-10-02 | FrostWire 6.14.0-build-326 for macOS contains permissive entitlements (allow-dyld-environment-variables, disable-library-validation) that allow unprivileged lo… |
CVE-2025-10578 | High | 7.8 | 2025-10-01 | A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.47.41.0. The vulnerability could potentially allow a… |
CVE-2025-7779 | High | 8.8 | 2025-09-30 | Local privilege escalation due to insecure XPC service configuration. The following products are affected: Acronis True Image (macOS) before build 42389, Acron… |
CVE-2025-10657 | | 2025-09-26 | In a hardened Docker environment, with Enhanced Container Isolation ( ECI https://docs.docker.com/enterprise/security/hardened-desktop/enhanced-container-isola… | |
CVE-2025-55187 | Critical | 9.9 | 2025-09-26 | In DriveLock 24.1.4 before 24.1.5, 24.2.5 before 24.2.6, and 25.1.2 before 25.1.4, attackers can gain elevated privileges. |
CVE-2025-5494 | Low | 3.9 | 2025-09-25 | ZohoCorp ManageEngine Endpoint Central was impacted by an improper privilege management issue in the agent setup. This issue affects Endpoint Central: through… |
CVE-2025-9966 | | 2025-09-23 | Improper privilege management vulnerability in Novakon P series allows attackers to gain root privileges if one service is compromized.This issue affects P ser… | |
CVE-2025-9038 | | 2025-09-22 | Improper Privilege Management vulnerability in GE Vernova S1 Agile Configuration Software on Windows allows Privilege Escalation.This issue affects S1 Agile Co… | |
CVE-2025-57396 | Medium | 6.5 | 2025-09-19 | Tandoor Recipes 2.0.0-alpha-1, fixed in 2.0.0-alpha-2, is vulnerable to privilege escalation. This is due to the rework of the API, which resulted in the User… |
CVE-2025-54761 | High | 8.0 | 2025-09-19 | An issue was discovered in PPress 0.0.9 allowing attackers to gain escilated privlidges via crafted session cookie. |
CVE-2025-34204 | Critical | 9.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) contains multiple Docker containers that run primary appl… |
CVE-2025-10650 | | 2025-09-18 | SoftIron HyperCloud 2.5.0 through 2.6.3 may incorrectly add user SSH keys to the administrator-level authorized keys under certain conditions, allowing unautho… | |
CVE-2025-58432 | High | 7.8 | 2025-09-17 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and all prior versions, the /v2_1/files/file/up… |
CVE-2025-37123 | High | 8.8 | 2025-09-16 | A vulnerability in the command-line interface of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to escalate priv… |
CVE-2025-34187 | High | 8.8 | 2025-09-16 | Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a misconfiguration in the sudoers file that allows passwordless execution of certain Bash scripts. If… |
CVE-2025-43333 | High | 7.8 | 2025-09-15 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to gain root privileges. |
CVE-2025-57118 | Critical | 9.8 | 2025-09-15 | An issue in PHPGurukul Online-Library-Management-System v3.0 allows an attacker to escalate privileges via the index.php |
CVE-2025-9059 | | 2025-09-11 | The Altiris Core Agent Updater package (AeXNSC.exe) is prone to an elevation of privileges vulnerability through DLL hijacking. | |
CVE-2025-50892 | High | 7.8 | 2025-09-10 | The eudskacs.sys driver version 20250328 shipped with EaseUs Todo Backup 1.2.0.1 fails to properly validate privileges for I/O requests (IRP_MJ_READ/IRP_MJ_WRI… |
CVE-2025-53914 | | 2025-09-09 | Excessive Privileges vulnerability in Calix GigaCenter ONT (Broadcom SoC modules) allows Privilege Abuse.This issue affects GigaCenter ONT: 844E, 844G, 844GE… | |
CVE-2025-53913 | | 2025-09-09 | Excessive Privileges vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows Privilege Abuse.This issue affects GigaCenter ONT: 844E, 844G, 844GE… | |
CVE-2025-52915 | High | 7.2 | 2025-09-09 | K7RKScan.sys 23.0.0.10, part of the K7 Security Anti-Malware suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that… |
CVE-2025-40594 | Medium | 6.3 | 2025-09-09 | A vulnerability has been identified in SINAMICS G220 V6.4 (All versions < V6.4 HF2), SINAMICS S200 V6.4 (All versions < V6.4 HF7), SINAMICS S210 V6.4 (All vers… |
CVE-2025-43722 | Medium | 6.7 | 2025-09-08 | Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper privilege management vulnerability. A high privileged attacker with local access could… |