CWE-269 · Improper Privilege Management (page 9)
Page 9 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-32345 | High | 7.8 | 2025-09-04 | In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to disable the primary user's deceptive app sc… |
CVE-2025-26462 | High | 7.8 | 2025-09-04 | In AccessibilityServiceConnection.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of… |
CVE-2025-26435 | High | 7.8 | 2025-09-04 | In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to disable the primary user's deceptive app sc… |
CVE-2025-36904 | Critical | 9.8 | 2025-09-04 | WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396458384. |
CVE-2025-36901 | High | 8.8 | 2025-09-04 | WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396462223. |
CVE-2025-36896 | Critical | 9.8 | 2025-09-04 | WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-394765106. |
CVE-2025-36891 | High | 8.8 | 2025-09-04 | Elevation of privilege |
CVE-2025-36890 | Critical | 9.8 | 2025-09-04 | Elevation of Privilege |
CVE-2025-32098 | Medium | 5.3 | 2025-09-02 | An issue was discovered in Samsung Magician 6.3 through 8.3 on Windows. An attacker can achieve Elevation of Privileges to SYSTEM by exploiting insecure file d… |
CVE-2024-46916 | High | 8.1 | 2025-08-29 | Diebold Nixdorf Vynamic Security Suite through 4.3.0 SR06 contains functionality that allows the removal of critical system files before the filesystem is prop… |
CVE-2025-57759 | Medium | 4.3 | 2025-08-28 | Contao is an Open Source CMS. In versions starting from 5.3.0 and prior to 5.3.38 and 5.6.1, under certain conditions, back end users may be able to edit field… |
CVE-2025-55582 | Medium | 6.6 | 2025-08-27 | D-Link DCS-825L firmware v1.08.01 contains a vulnerability in the watchdog script `mydlink-watch-dog.sh`, which blindly respawns binaries such as `dcp` and `si… |
CVE-2025-53105 | High | 7.5 | 2025-08-27 | GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, l… |
CVE-2025-36729 | High | 7.2 | 2025-08-26 | A non-primary administrator user with admin rights to the web interface but without shell access permissions can display configuration of the device including… |
CVE-2025-6366 | High | 8.8 | 2025-08-26 | The Event List plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.0.4. This is due to the plugin not properly v… |
CVE-2024-47853 | High | 8.8 | 2025-08-26 | An issue was discovered in Mahara 23.04.8 and 24.04.4. Attackers may utilize escalation of privileges in certain cases when logging into Mahara with Learning T… |
CVE-2025-5931 | High | 8.8 | 2025-08-26 | The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.5. This is due to the p… |
CVE-2025-57760 | High | 8.8 | 2025-08-25 | Langflow is a tool for building and deploying AI-powered agents and workflows. A privilege escalation vulnerability exists in Langflow containers where an auth… |
CVE-2025-55581 | High | 7.3 | 2025-08-22 | D-Link DCS-825L firmware version 1.08.01 and possibly prior versions contain an insecure implementation in the mydlink-watch-dog.sh script. The script monitors… |
CVE-2025-55627 | Medium | 5.3 | 2025-08-22 | Insufficient privilege verification in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allows authenticated attacke… |
CVE-2025-50674 | High | 7.8 | 2025-08-22 | An issue was discovered in the changePassword method in file /usr/share/php/openmediavault/system/user.inc in OpenMediaVault 7.4.17 allowing local authenticate… |
CVE-2025-8309 | High | 8.1 | 2025-08-20 | There is an improper privilege management vulnerability identified in ManageEngine's Asset Explorer, ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter… |
CVE-2025-6182 | | 2025-08-20 | The StrongDM Windows service incorrectly handled communication related to system certificate management. Attackers could exploit this behavior to install untru… | |
CVE-2025-8453 | Medium | 6.7 | 2025-08-20 | CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation and arbitrary code execution when a privileged engineer user… |
CVE-2025-8218 | High | 8.8 | 2025-08-19 | The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'change_role_member' parameter in all… |
CVE-2025-6758 | Critical | 9.8 | 2025-08-19 | The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'imic_agent_register' function in all… |
CVE-2025-6080 | High | 8.8 | 2025-08-16 | The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to unauthorized admin account creation in all versions up to, and including, 67… |
CVE-2025-27847 | Medium | 4.3 | 2025-08-14 | In ESPEC North America Web Controller 3 before 3.3.8, /api/v4/auth/ users session privileges are not revoked on logout. |
CVE-2025-27846 | Medium | 4.3 | 2025-08-14 | In ESPEC North America Web Controller 3 before 3.3.8, an attacker with physical access can gain elevated privileges because GRUB and the BIOS are unprotected. |
CVE-2025-49758 | High | 8.8 | 2025-08-12 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a n… |
CVE-2025-8660 | Critical | 9.8 | 2025-08-11 | Privilege escalation occurs when a user gets access to more resources or functionality than they are normally allowed. |
CVE-2025-54996 | High | 7.2 | 2025-08-09 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and… |
CVE-2025-26513 | High | 7.0 | 2025-08-07 | The installer for SAN Host Utilities for Windows versions prior to 8.0 is susceptible to a vulnerability which when successfully exploited could allow a local… |
CVE-2025-6994 | Critical | 9.8 | 2025-08-06 | The Reveal Listing plugin by smartdatasoft for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.3. This is due to the plugin… |
CVE-2025-54594 | Critical | 9.1 | 2025-08-06 | react-native-bottom-tabs is a library of Native Bottom Tabs for React Native. In versions 0.9.2 and below, the github/workflows/release-canary.yml GitHub Actio… |
CVE-2013-10052 | | 2025-08-04 | ZPanel includes a helper binary named zsudo, intended to allow restricted privilege escalation for administrative tasks. However, when misconfigured in /etc/su… | |
CVE-2012-10022 | | 2025-08-01 | Kloxo versions 6.1.12 and earlier contain two setuid root binaries—lxsuexec and lxrestart—that allow local privilege escalation from uid 48. The lxsuexec binar… | |
CVE-2025-54595 | High | 7.3 | 2025-08-01 | Pearcleaner is a free, source-available and fair-code licensed mac app cleaner. The PearcleanerHelper is a privileged helper tool bundled with the Pearcleaner… |
CVE-2025-5954 | Critical | 9.8 | 2025-08-01 | The Service Finder SMS System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This… |
CVE-2025-52289 | High | 8.0 | 2025-07-31 | A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbi… |
CVE-2025-43256 | High | 7.8 | 2025-07-30 | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. An app may be able to gain root pri… |
CVE-2025-43249 | High | 7.8 | 2025-07-30 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to g… |
CVE-2025-43248 | High | 7.8 | 2025-07-30 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. A malicious app may be able to gain roo… |
CVE-2025-43199 | Critical | 9.8 | 2025-07-30 | A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. A mali… |
CVE-2025-43188 | High | 7.8 | 2025-07-30 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6. A malicious app may be able to gain root privileges. |
CVE-2025-31243 | High | 7.8 | 2025-07-30 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app ma… |
CVE-2025-24119 | High | 7.8 | 2025-07-30 | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be… |
CVE-2024-13975 | | 2025-07-25 | A local privilege escalation vulnerability exists in Commvault for Windows versions 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. In affected configurations… | |
CVE-2024-48730 | Medium | 6.5 | 2025-07-25 | The default configuration in ETSI Open-Source MANO (OSM) v.14.x, v.15.x, v.16.x, v.17.x does not impose any restrictions on the authentication attempts perform… |
CVE-2024-48729 | High | 7.1 | 2025-07-25 | An issue in ETSI Open-Source MANO (OSM) 14.0.x before 14.0.3, 15.0.x before 15.0.2, 16.0.0, and 17.0.0 allows a remote authenticated attacker to escalate privi… |
CVE-2025-22165 | High | 7.3 | 2025-07-24 | This Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8 of Sourcetree for Mac. This ACE (Arbitrary Code Execution) v… |
CVE-2025-8107 | Medium | 6.3 | 2025-07-24 | In OceanBase's Oracle tenant mode, a malicious user with specific privileges can achieve privilege escalation to SYS-level access by executing carefully crafte… |
CVE-2025-53942 | High | 7.4 | 2025-07-23 | authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set of protocols. In versions 2025.4.4 and e… |
CVE-2016-15045 | | 2025-07-23 | A local privilege escalation vulnerability exists in lastore-daemon, the system package manager daemon used in Deepin Linux (developed by Wuhan Deepin Technolo… | |
CVE-2025-34143 | | 2025-07-22 | An authentication bypass vulnerability exists in ETQ Reliance on the CG (legacy) platform. The application allowed login as the privileged internal SYSTEM user… | |
CVE-2025-46116 | High | 8.8 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where an a… |
CVE-2015-10139 | High | 8.8 | 2025-07-19 | The WPLMS theme for WordPress is vulnerable to Privilege Escalation in versions 1.5.2 to 1.8.4.1 via the 'wp_ajax_import_data' AJAX action. This makes it possi… |
CVE-2025-7784 | Medium | 6.5 | 2025-07-18 | A flaw was found in the Keycloak identity and access management system when Fine-Grained Admin Permissions(FGAPv2) are enabled. An administrative user with the… |
CVE-2025-53030 | Medium | 6.0 | 2025-07-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.1.10. Easily exploi… |
CVE-2025-53029 | Low | 2.3 | 2025-07-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.1.10. Easily exploi… |
CVE-2025-53027 | High | 8.2 | 2025-07-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.1.10. Easily exploi… |
CVE-2025-53026 | Medium | 6.0 | 2025-07-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.1.10. Easily exploi… |
CVE-2025-53025 | Medium | 6.0 | 2025-07-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.1.10. Easily exploi… |
CVE-2025-53024 | High | 8.2 | 2025-07-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.1.10. Easily exploi… |
CVE-2025-50069 | High | 7.7 | 2025-07-15 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.27 and 21.3-21.18. Easily exploitable vuln… |
CVE-2025-50066 | Low | 2.7 | 2025-07-15 | Vulnerability in the Oracle Database Materialized View component of Oracle Database Server. Supported versions that are affected are 19.3-19.27, 21.3-21.18 an… |
CVE-2025-50065 | Low | 3.7 | 2025-07-15 | Vulnerability in the Oracle GraalVM for JDK product of Oracle Java SE (component: Native Image). The supported version that is affected is Oracle GraalVM for… |
CVE-2025-50064 | Medium | 4.8 | 2025-07-15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1… |
CVE-2025-50062 | High | 8.1 | 2025-07-15 | Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Core product of Oracle PeopleSoft (component: Global Payroll for Core). Supported versions that… |
CVE-2025-50061 | Medium | 5.4 | 2025-07-15 | Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported ve… |
CVE-2025-7341 | Critical | 9.1 | 2025-07-15 | The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to in… |
CVE-2025-50124 | | 2025-07-11 | A CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the server is accessed by a privileged account vi… | |
CVE-2025-5028 | | 2025-07-11 | Installation file of ESET security products on Windows allow an attacker to misuse to delete an arbitrary file without having the permissions to do so. | |
CVE-2025-6759 | High | 7.8 | 2025-07-08 | Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Windows Virtual Delivery Agent for CVAD and Citrix DaaS |
CVE-2025-43019 | High | 7.8 | 2025-07-08 | A potential security vulnerability has been identified in the HP Support Assistant, which allows a local attacker to escalate privileges via an arbitrary file… |
CVE-2025-24006 | High | 7.8 | 2025-07-08 | A low privileged local attacker can leverage insecure permissions via SSH on the affected devices to escalate privileges to root. |
CVE-2025-6943 | Low | 3.8 | 2025-07-02 | Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator to gain access to restricted tables. |
CVE-2025-36630 | High | 8.4 | 2025-07-02 | In Tenable Nessus versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log… |
CVE-2025-6934 | Critical | 9.8 | 2025-07-01 | The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to… |
CVE-2025-53003 | | 2025-07-01 | The Janssen Project is an open-source identity and access management (IAM) platform. Prior to version 1.8.0, the Config API returns results without scope verif… | |
CVE-2025-45737 | Medium | 6.5 | 2025-06-27 | An issue in NetEase (Hangzhou) Network Co., Ltd NeacSafe64 Driver before v1.0.0.8 allows attackers to escalate privileges via sending crafted IOCTL commands to… |
CVE-2025-52555 | Medium | 6.5 | 2025-06-26 | Ceph is a distributed object, block, and file storage platform. In versions 17.2.7, 18.2.1 through 18.2.4, and 19.0.0 through 19.2.2, an unprivileged user can… |
CVE-2025-37101 | High | 8.7 | 2025-06-26 | A potential security vulnerability has been identified in HPE OneView for VMware vCenter (OV4VC). This vulnerability could be exploited allowing an attacker wi… |
CVE-2025-4334 | Critical | 9.8 | 2025-06-26 | The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3. This is due to insufficient… |
CVE-2025-20282 | Critical | 10.0 | 2025-06-25 | A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected devi… |
CVE-2025-39202 | High | 7.3 | 2025-06-24 | A vulnerability exists in in the Monitor Pro interface of the MicroSCADA X SYS600 product. An authenticated user with low privileges can see and overwrite file… |
CVE-2023-50450 | High | 8.4 | 2025-06-23 | An issue was discovered in Sensopart VISOR Vision Sensors before 2.10.0.2 allows local users to perform unspecified actions with elevated privileges. |
CVE-2025-24286 | High | 7.2 | 2025-06-19 | A vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code. |
CVE-2025-49157 | High | 7.8 | 2025-06-17 | A link following vulnerability in the Trend Micro Apex One Damage Cleanup Engine could allow a local attacker to escalation privileges on affected installation… |
CVE-2025-49156 | High | 7.0 | 2025-06-17 | A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalation privileges on affected installations. Plea… |
CVE-2025-4879 | High | 7.8 | 2025-06-17 | Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows |
CVE-2025-0320 | High | 7.8 | 2025-06-17 | Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Secure Access Client for Windows |
CVE-2025-6177 | High | 7.4 | 2025-06-16 | Privilege Escalation in MiniOS in Google ChromeOS (16063.45.2 and potentially others) on enrolled devices allows a local attacker to gain root code execution v… |
CVE-2025-5689 | High | 8.5 | 2025-06-16 | A flaw was found in the temporary user record that authd uses in the pre-auth NSS. As a result, a user login for the first time will be considered to be part o… |
CVE-2025-36633 | High | 8.8 | 2025-06-13 | In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could arbitrarily delete local system files with SYSTE… |
CVE-2025-36631 | High | 8.4 | 2025-06-13 | In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log… |
CVE-2025-5491 | High | 8.8 | 2025-06-13 | Acer ControlCenter contains Remote Code Execution vulnerability. The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functi… |
CVE-2025-5687 | High | 7.8 | 2025-06-11 | A vulnerability in Mozilla VPN on macOS allows privilege escalation from a normal user to root. *This bug only affects Mozilla VPN on macOS. Other operating sy… |
CVE-2025-4315 | High | 8.8 | 2025-06-11 | The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.23. This… |
CVE-2025-47849 | High | 8.8 | 2025-06-10 | A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can… |