CWE-284 · Improper Access Control (page 22)
Page 22 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-0547 | Medium | 6.3 | 2026-01-02 | A vulnerability was found in PHPGurukul Online Course Registration up to 3.1. This issue affects some unknown processing of the file /admin/edit-student-profil… |
CVE-2025-15426 | High | 7.3 | 2026-01-02 | A vulnerability was identified in jackying H-ui.admin up to 3.1. This affects an unknown function in the library /lib/webuploader/0.1.5/server/preview.php. The… |
CVE-2025-15423 | Medium | 6.3 | 2026-01-02 | A vulnerability has been found in EmpireSoft EmpireCMS up to 8.0. Impacted is the function CheckSaveTranFiletype of the file e/class/connect.php. Such manipula… |
CVE-2025-15415 | Medium | 4.7 | 2026-01-01 | A vulnerability has been found in xnx3 wangmarket up to 6.4. The impacted element is the function uploadImage of the file /sits/uploadImage.do of the component… |
CVE-2025-15404 | Medium | 6.3 | 2026-01-01 | A security vulnerability has been detected in campcodes School File Management System 1.0. The affected element is an unknown function of the file /save_file.p… |
CVE-2025-15360 | Medium | 4.7 | 2025-12-30 | A vulnerability was determined in newbee-mall-plus 2.0.0. This impacts the function Upload of the file src/main/java/ltd/newbee/mall/controller/common/UploadCo… |
CVE-2025-69257 | Medium | 6.7 | 2025-12-30 | theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.1.1, the application loads custom… |
CVE-2025-15262 | Medium | 4.7 | 2025-12-30 | A security flaw has been discovered in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/edit.php of the component Site Logo H… |
CVE-2023-32238 | Medium | 5.4 | 2025-12-30 | Vulnerability in CodexThemes TheGem (Elementor), CodexThemes TheGem (WPBakery).This issue affects TheGem (Elementor): from n/a before 5.8.1.1; TheGem (WPBakery… |
CVE-2025-15199 | Medium | 6.3 | 2025-12-29 | A security vulnerability has been detected in code-projects College Notes Uploading System 1.0. Impacted is an unknown function of the file /dashboard/userprof… |
CVE-2025-15197 | Medium | 4.7 | 2025-12-29 | A security flaw has been discovered in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. This vulnerability affects unknown code of the… |
CVE-2025-15152 | Medium | 6.3 | 2025-12-28 | A vulnerability was identified in h-moses moga-mall up to 392d631a5ef15962a9bddeeb9f1269b9085473fa. This vulnerability affects the function addProduct of the f… |
CVE-2025-15141 | Low | 3.1 | 2025-12-28 | A vulnerability was determined in Halo up to 2.21.10. This issue affects some unknown processing of the file /actuator of the component Configuration Handler… |
CVE-2025-15121 | Low | 2.4 | 2025-12-28 | A vulnerability has been found in JeecgBoot up to 3.9.0. The affected element is the function getDeptRoleByUserId of the file /sys/sysDepartRole/getDeptRoleByU… |
CVE-2025-15110 | Medium | 4.7 | 2025-12-27 | A vulnerability has been found in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Affected is the function Upload of the file Admin/Home/Controller/… |
CVE-2025-15109 | High | 7.3 | 2025-12-27 | A flaw has been found in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. This impacts an unknown function of the file Public/javascripts/admin/plupl… |
CVE-2025-67015 | High | 7.5 | 2025-12-26 | Incorrect access control in Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem with firmware v2.5.1 allows attackers to change the Administrator passw… |
CVE-2025-67014 | High | 7.5 | 2025-12-26 | Incorrect access control in DEV Systemtechnik GmbH DEV 7113 RF over Fiber Distribution System 32-0078 H.01 allows unauthenticated attackers to access an admini… |
CVE-2025-15086 | Medium | 4.3 | 2025-12-25 | A weakness has been identified in youlaitech youlai-mall 1.0.0/2.0.0. This impacts the function getMemberByMobile of the file mall-ums/ums-boot/src/main/java/c… |
CVE-2025-15084 | Low | 3.1 | 2025-12-25 | A vulnerability was identified in youlaitech youlai-mall 1.0.0/2.0.0. The impacted element is the function orderService.payOrder of the file mall-oms/oms-boot/… |
CVE-2025-15082 | Medium | 5.3 | 2025-12-25 | A vulnerability was found in TOZED ZLT M30s up to 1.47. Impacted is an unknown function of the file /reqproc/proc_post of the component Web Management Interfac… |
CVE-2025-15050 | Medium | 6.3 | 2025-12-24 | A security vulnerability has been detected in code-projects Student File Management System 1.0. This affects an unknown part of the file /save_file.php. Such m… |
CVE-2025-66736 | High | 7.1 | 2025-12-22 | youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. The importUsers function in SysUserController.java does not perform a permission check on the cu… |
CVE-2025-66735 | High | 7.5 | 2025-12-22 | youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. The getRoleForm function in SysRoleController.java does not perform permission checks, which may… |
CVE-2025-63664 | High | 7.5 | 2025-12-22 | Incorrect access control in the /api/v1/conversations/*/messages API of GT Edge AI Platform before v2.0.10-dev allows unauthorized attackers to access other us… |
CVE-2025-63663 | High | 7.5 | 2025-12-22 | Incorrect access control in the /api/v1/conversations/*/files API of GT Edge AI Platform before v2.0.10 allows unauthorized attackers to access other users' up… |
CVE-2025-15009 | Medium | 6.3 | 2025-12-22 | A flaw has been found in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function FilenameUtils.getExtension of the file /dev-api/common/upload… |
CVE-2025-66911 | Medium | 6.5 | 2025-12-19 | Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. The handleQueryUserO… |
CVE-2025-64400 | Medium | 4.1 | 2025-12-18 | Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login. The API for creating users checks that th… |
CVE-2025-63387 | High | 7.5 | 2025-12-18 | Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint… |
CVE-2025-14885 | Medium | 6.3 | 2025-12-18 | A flaw has been found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file /user_leads.php of the component Leads… |
CVE-2025-67789 | Medium | 5.3 | 2025-12-17 | An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Authenticated users can retrieve the computer count of oth… |
CVE-2025-46292 | Medium | 5.5 | 2025-12-17 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2. An app may be able… |
CVE-2025-46288 | Medium | 5.5 | 2025-12-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2… |
CVE-2025-46282 | Medium | 5.5 | 2025-12-17 | The issue was addressed with additional permissions checks. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. An app may be able to access sensitive user d… |
CVE-2025-66397 | High | 8.3 | 2025-12-17 | ChurchCRM is an open-source church management system. Prior to version 6.5.3, the allowRegistration, acceptKiosk, reloadKiosk, and identifyKiosk functions in t… |
CVE-2025-14095 | Medium | 6.8 | 2025-12-17 | A "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products. Exploitation of this vulnerability gives a user with physi… |
CVE-2025-11901 | | 2025-12-17 | An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z… | |
CVE-2025-14749 | Medium | 6.3 | 2025-12-16 | A vulnerability was identified in Ningyuanda TC155 57.0.2.0. This impacts an unknown function of the file /onvif/device_service of the component ONVIF PTZ Cont… |
CVE-2025-14748 | Medium | 5.4 | 2025-12-16 | A vulnerability was determined in Ningyuanda TC155 57.0.2.0. This affects an unknown function of the file /onvif/device_service of the component ONVIF Device M… |
CVE-2025-67715 | Medium | 4.3 | 2025-12-16 | Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version… |
CVE-2025-55895 | Critical | 9.1 | 2025-12-15 | TOTOLINK A3300R V17.0.0cu.557_B20221024 and N200RE V9.3.5u.6448_B20240521 and V9.3.5u.6437_B20230519 are vulnerable to Incorrect Access Control. Attackers can… |
CVE-2025-65176 | High | 7.5 | 2025-12-15 | An issue was discovered in Dynatrace OneAgent before 1.325.47. When attempting to access a remote network share from a machine where OneAgent is installed and… |
CVE-2025-65780 | High | 8.8 | 2025-12-15 | An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire user docu… |
CVE-2025-65779 | High | 7.5 | 2025-12-15 | An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Unauthenticated attackers can update a board's "sort"… |
CVE-2025-14660 | Medium | 5.6 | 2025-12-14 | A flaw has been found in DecoCMS Mesh up to 1.0.0-alpha.31. Affected by this vulnerability is the function createTool of the file packages/sdk/src/mcp/teams/ap… |
CVE-2025-14642 | Medium | 4.7 | 2025-12-14 | A vulnerability has been found in code-projects Computer Laboratory System 1.0. Impacted is an unknown function of the file technical_staff_pic.php. Such manip… |
CVE-2025-14641 | Medium | 4.7 | 2025-12-14 | A flaw has been found in code-projects Computer Laboratory System 1.0. This issue affects some unknown processing of the file admin/admin_pic.php. This manipul… |
CVE-2025-14583 | High | 7.3 | 2025-12-12 | A flaw has been found in campcodes Online Student Enrollment System 1.0. This impacts an unknown function of the file /admin/register.php. Executing a manipula… |
CVE-2025-14582 | Medium | 4.7 | 2025-12-12 | A vulnerability was detected in campcodes Online Student Enrollment System 1.0. This affects an unknown function of the file /admin/index.php?page=user-profile… |
CVE-2025-43518 | Low | 3.3 | 2025-12-12 | A logic issue was addressed with improved checks. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2… |
CVE-2025-43513 | Medium | 5.5 | 2025-12-12 | A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app m… |
CVE-2025-43416 | Medium | 5.5 | 2025-12-12 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able… |
CVE-2025-43404 | Low | 3.3 | 2025-12-12 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user da… |
CVE-2025-43393 | Medium | 5.2 | 2025-12-12 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to break out of its sandbox. |
CVE-2025-43351 | Medium | 5.5 | 2025-12-12 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access protected user data. |
CVE-2025-66430 | Critical | 9.1 | 2025-12-12 | Plesk 18.0 has Incorrect Access Control. |
CVE-2025-64669 | High | 7.8 | 2025-12-11 | Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges locally. |
CVE-2025-14530 | Medium | 4.7 | 2025-12-11 | A vulnerability has been found in SourceCodester Real Estate Property Listing App 1.0. The impacted element is an unknown function of the file /admin/property… |
CVE-2025-14528 | Medium | 5.3 | 2025-12-11 | A vulnerability was detected in D-Link DIR-803 up to 1.04. Impacted is an unknown function of the file /getcfg.php of the component Configuration Handler. The… |
CVE-2025-14522 | Medium | 6.3 | 2025-12-11 | A vulnerability was detected in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. The impacted element is an unknown function of the file /Public/Kin… |
CVE-2025-67510 | Critical | 9.4 | 2025-12-10 | Neuron is a PHP framework for creating and orchestrating AI Agents. In versions 2.8.11 and below, the MySQLWriteTool executes arbitrary SQL provided by the cal… |
CVE-2025-24857 | High | 7.6 | 2025-12-10 | Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019, IPQ5018, IPQ5322… |
CVE-2025-14082 | Low | 2.7 | 2025-12-10 | A flaw was found in Keycloak Admin REST (Representational State Transfer) API. This vulnerability allows information disclosure of sensitive role metadata via… |
CVE-2025-64897 | Medium | 5.6 | 2025-12-10 | ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability. A low privileged attacker could leverage thi… |
CVE-2025-65594 | High | 8.1 | 2025-12-09 | OpenSIS 9.2 and below is vulnerable to Incorrect Access Control in Student.php, which allows an authenticated low-privilege user to perform unauthorized databa… |
CVE-2025-64673 | High | 7.8 | 2025-12-09 | Improper access control in Storvsp.sys Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-62570 | High | 7.1 | 2025-12-09 | Improper access control in Windows Camera Frame Server Monitor allows an authorized attacker to disclose information locally. |
CVE-2025-62474 | High | 7.8 | 2025-12-09 | Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. |
CVE-2025-59923 | Low | 2.7 | 2025-12-09 | An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all ve… |
CVE-2025-59810 | Medium | 6.5 | 2025-12-09 | An improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSOAR PaaS 7.4 all versions, F… |
CVE-2025-59517 | High | 7.8 | 2025-12-09 | Improper access control in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-63739 | Medium | 4.3 | 2025-12-09 | An issue was discovered in function phpinisaveAction in file webmain/system/cogini/coginiAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to authen… |
CVE-2025-40939 | Medium | 4.6 | 2025-12-09 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device contains a USB port which allows unauthenticated connection… |
CVE-2025-14286 | Medium | 5.3 | 2025-12-09 | A vulnerability was determined in Tenda AC9 15.03.05.14_multi. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/DownloadCfg.jpg… |
CVE-2025-65797 | Medium | 6.5 | 2025-12-08 | Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete… |
CVE-2025-65795 | High | 7.5 | 2025-12-08 | Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted reques… |
CVE-2025-65798 | Medium | 5.4 | 2025-12-08 | Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete attachments made by other users. |
CVE-2025-65796 | Medium | 4.3 | 2025-12-08 | Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily delete reactions made to other users' Memos. |
CVE-2025-14219 | Medium | 4.7 | 2025-12-08 | A weakness has been identified in Campcodes Retro Basketball Shoes Online Store 1.0. The impacted element is an unknown function of the file /admin/admin_runni… |
CVE-2025-14199 | Medium | 6.3 | 2025-12-07 | A flaw has been found in Verysync 微力同步 up to 2.21.3. This impacts an unknown function of the file /rest/f/api/resources/f96956469e7be39d/tmp/text.txt?override=… |
CVE-2025-14198 | Medium | 5.3 | 2025-12-07 | A vulnerability was detected in Verysync 微力同步 2.21.3. This affects an unknown function of the file /safebrowsing/clientreport/download?key=dummytoken of the co… |
CVE-2025-14197 | Medium | 5.3 | 2025-12-07 | A security vulnerability has been detected in Verysync 微力同步 up to 2.21.3. The impacted element is an unknown function of the file /rest/f/api/resources/f969564… |
CVE-2025-14195 | Medium | 6.3 | 2025-12-07 | A security flaw has been discovered in code-projects Employee Profile Management System 1.0. Impacted is an unknown function of the file /profiling/add_file_qu… |
CVE-2025-66557 | Medium | 5.4 | 2025-12-05 | Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.14.6 and… |
CVE-2025-14086 | Medium | 6.3 | 2025-12-05 | A vulnerability was found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is an unknown function of the file /app-api/v1/members/openid/. The manipulation of t… |
CVE-2025-14052 | Medium | 6.3 | 2025-12-05 | A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected by this vulnerability is the function getMemberById of the file /mall-ums/app-ap… |
CVE-2025-66509 | Critical | 9.8 | 2025-12-04 | LaraDashboard is an all-In-one solution to start a Laravel Application. In 2.3.0 and earlier, the password reset flow trusts the Host header, allowing attacker… |
CVE-2025-63363 | High | 7.5 | 2025-12-04 | A lack of Management Frame Protection in Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07… |
CVE-2025-63681 | Medium | 4.3 | 2025-12-04 | open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, en… |
CVE-2025-57213 | High | 7.5 | 2025-12-04 | Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensitive information via a crafted request. |
CVE-2025-57212 | High | 7.5 | 2025-12-04 | Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive information via a crafted request. |
CVE-2025-57210 | High | 7.5 | 2025-12-04 | Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive information via unspecified vectors. |
CVE-2025-65097 | Medium | 6.5 | 2025-12-03 | RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2… |
CVE-2025-65096 | Medium | 4.3 | 2025-12-03 | RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2… |
CVE-2025-65841 | Medium | 6.2 | 2025-12-03 | Aquarius Desktop 3.0.069 for macOS stores user authentication credentials in the local file ~/Library/Application Support/Aquarius/aquarius.settings using a we… |
CVE-2025-13949 | Medium | 6.3 | 2025-12-03 | A vulnerability was identified in ProudMuBai GoFilm 1.0.0/1.0.1. Impacted is the function SingleUpload of the file /server/controller/FileController.go. The ma… |
CVE-2025-59703 | Critical | 9.1 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a Physically Proximate Attacker to access the internal components of t… |
CVE-2025-59702 | High | 7.2 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker with elevated privileges to falsify ta… |
CVE-2025-59697 | High | 7.2 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker to escalate privileges by editing the… |