CWE-284 · Improper Access Control (page 24)
Page 24 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-43413 | High | 7.5 | 2025-11-04 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2… |
CVE-2025-43412 | Medium | 6.3 | 2025-11-04 | A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may b… |
CVE-2025-43408 | Low | 2.4 | 2025-11-04 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1… |
CVE-2025-43407 | High | 7.8 | 2025-11-04 | This issue was addressed with improved entitlements. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS… |
CVE-2025-43396 | Medium | 5.5 | 2025-11-04 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. A sandboxed app may be ab… |
CVE-2025-43335 | Medium | 5.5 | 2025-11-04 | The issue was addressed by adding additional logic. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to a… |
CVE-2025-43334 | Medium | 5.5 | 2025-11-04 | This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be… |
CVE-2025-43322 | Medium | 5.5 | 2025-11-04 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to acc… |
CVE-2025-43309 | Low | 2.4 | 2025-11-04 | A logic issue was addressed with improved checks. This issue is fixed in iOS 26 and iPadOS 26. An attacker with physical access to an iOS device may be able to… |
CVE-2025-12593 | Medium | 4.7 | 2025-11-02 | A vulnerability was identified in code-projects Simple Online Hotel Reservation System 2.0. The impacted element is an unknown function of the file /admin/edit… |
CVE-2025-63562 | Medium | 6.3 | 2025-10-31 | Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 suffers from insufficient server-side authorization. Authenticated attackers can call se… |
CVE-2025-29270 | Critical | 10.0 | 2025-10-31 | Incorrect access control in the realtime.cgi endpoint of Deep Sea Electronics devices DSE855 v1.1.0 to v1.1.26 allows attackers to gain access to the admin pan… |
CVE-2025-48983 | Critical | 9.9 | 2025-10-31 | A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authe… |
CVE-2025-63423 | High | 7.5 | 2025-10-30 | Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 was discovered to store the Administrator password. |
CVE-2025-63422 | High | 7.5 | 2025-10-30 | Incorrect access control in the Web management interface in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to arbitr… |
CVE-2025-61120 | High | 7.5 | 2025-10-30 | AG Life Logger Android App version v1.0.2.72 and before (package name com.donki.healthy), developed by IO FIT, K.K., contains improper access control vulnerabi… |
CVE-2025-61119 | High | 7.5 | 2025-10-30 | Kanova Android App version 1.0.27 (package name com.karelane), developed by Karely L.L.C., contains improper access control vulnerabilities. Attackers may gain… |
CVE-2025-61114 | High | 7.5 | 2025-10-30 | 2nd Line Android App version v1.2.92 and before (package name com.mysecondline.app), developed by AutoBizLine, Inc., contains an improper access control vulner… |
CVE-2025-61118 | High | 7.5 | 2025-10-30 | mCarFix Motorists App version 2.3 (package name com.skytop.mcarfix), developed by Paniel Mwaura, contains improper access control vulnerabilities. Attackers ma… |
CVE-2025-61117 | High | 7.5 | 2025-10-30 | Senza: Keto & Fasting Android App version 2.10.15 (package name com.gl.senza), developed by Paul Itoi, contains an improper access control vulnerability. By ex… |
CVE-2025-61116 | High | 7.5 | 2025-10-30 | AdForest - Classified Android App version 4.0.12 (package name scriptsbundle.adforest), developed by Muhammad Jawad Arshad, contains an improper access control… |
CVE-2025-61115 | High | 7.5 | 2025-10-30 | ABC Fine Wine & Spirits Android App version v.11.27.5 and before (package name com.cta.abcfinewineandspirits), developed by ABC Liquors, Inc., contains an impr… |
CVE-2025-61113 | High | 7.5 | 2025-10-30 | TalkTalk 3.3.6 Android App contains improper access control vulnerabilities in multiple API endpoints. By modifying request parameters, attackers may obtain se… |
CVE-2025-43027 | Critical | 9.8 | 2025-10-30 | A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain administrative access to t… |
CVE-2025-61234 | High | 7.5 | 2025-10-29 | Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local network without authentication. This allows a… |
CVE-2025-61156 | High | 7.8 | 2025-10-29 | Incorrect access control in the kernel driver of ThreatFire System Monitor v4.7.0.53 allows attackers to escalate privileges and execute arbitrary commands via… |
CVE-2025-27093 | Medium | 6.3 | 2025-10-28 | Sliver is a command and control framework that uses a custom Wireguard netstack. In versions 1.5.43 and earlier, and in development version 1.6.0-dev, the nets… |
CVE-2025-60800 | High | 7.5 | 2025-10-28 | Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted… |
CVE-2025-60354 | High | 7.5 | 2025-10-28 | Unauthorized modification of arbitrary articles vulnerability exists in blog-vue-springboot. |
CVE-2025-12378 | High | 7.3 | 2025-10-28 | A security flaw has been discovered in code-projects Simple Food Ordering System 1.0. This issue affects some unknown processing of the file /addproduct.php. P… |
CVE-2025-12347 | Medium | 6.3 | 2025-10-28 | A flaw has been found in MaxSite CMS up to 109. This issue affects some unknown processing of the file application/maxsite/admin/plugins/editor_files/save-file… |
CVE-2025-12346 | Medium | 6.3 | 2025-10-28 | A vulnerability was detected in MaxSite CMS up to 109. This vulnerability affects unknown code of the file application/maxsite/admin/plugins/auto_post/uploads-… |
CVE-2025-12344 | Medium | 6.3 | 2025-10-28 | A vulnerability has been found in Yonyou U8 Cloud up to 5.1sp. The impacted element is an unknown function of the file /service/NCloudGatewayServlet of the com… |
CVE-2025-12331 | Medium | 4.7 | 2025-10-27 | A weakness has been identified in Willow CMS up to 1.4.0. Impacted is an unknown function of the file /admin/images/add. This manipulation causes unrestricted… |
CVE-2025-60982 | Medium | 5.4 | 2025-10-27 | IDOR vulnerability in Educare ERP 1.0 (2025-04-22) allows unauthorized access to sensitive data via manipulated object references. Affected endpoints do not en… |
CVE-2025-12301 | High | 7.3 | 2025-10-27 | A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Impacted is an unknown function of the file /editproduct.php. Such… |
CVE-2025-54970 | Medium | 6.5 | 2025-10-27 | An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service fails to authenticate requests. In some configurations, this may allo… |
CVE-2025-54968 | High | 8.8 | 2025-10-27 | An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Service does not require authentication. In some configurations, this may allow remo… |
CVE-2025-12297 | Medium | 4.3 | 2025-10-27 | A vulnerability was detected in atjiu pybbs up to 6.0.0. This affects an unknown function of the file UserApiController.java. The manipulation results in infor… |
CVE-2025-12291 | Medium | 4.7 | 2025-10-27 | A vulnerability was found in ashymuzuro Full-Ecommece-Website and Muzuro Ecommerce System up to 1.1.0. This affects an unknown part of the file /admin/index.ph… |
CVE-2023-37749 | Medium | 5.3 | 2025-10-27 | Incorrect access control in the REST API endpoint of HubSpot v1.29441 allows unauthenticated attackers to view users' data without proper authorization. |
CVE-2025-60291 | Critical | 9.1 | 2025-10-27 | An issue was discovered in eTimeTrackLite Web thru 12.0 (20250704). There is a permission control flaw that allows unauthorized attackers to access specific ro… |
CVE-2025-12276 | Medium | 4.3 | 2025-10-27 | A vulnerability was detected in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. Affected by this issue is some unknown functionality of the componen… |
CVE-2025-12268 | Medium | 6.3 | 2025-10-27 | A vulnerability has been found in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. Impacted is an unknown function of the file /api/v1/courses/ of th… |
CVE-2025-12223 | Medium | 6.3 | 2025-10-27 | A vulnerability was detected in Bdtask Flight Booking Software up to 3.1. This affects an unknown part of the file /b2c/package-information of the component Pa… |
CVE-2025-12222 | Medium | 6.3 | 2025-10-27 | A security vulnerability has been detected in Bdtask Flight Booking Software up to 3.1. Affected by this issue is some unknown functionality of the file /admin… |
CVE-2025-12201 | Medium | 4.7 | 2025-10-27 | A vulnerability was identified in ajayrandhawa User-Management-PHP-MYSQL up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This affects an unknown part of the fi… |
CVE-2025-6680 | Medium | 4.3 | 2025-10-25 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2025-59500 | High | 7.7 | 2025-10-23 | Improper access control in Azure Notification Service allows an authorized attacker to elevate privileges over a network. |
CVE-2025-59273 | High | 7.3 | 2025-10-23 | Improper access control in Azure Event Grid allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-62713 | | 2025-10-23 | Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execution (RCE) vulnerab… | |
CVE-2025-62395 | Medium | 4.3 | 2025-10-23 | A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information from the system context, revealing restri… |
CVE-2025-62393 | Medium | 4.3 | 2025-10-23 | A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view info… |
CVE-2025-62290 | High | 7.2 | 2025-10-21 | Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block Storage). The supported version that is affected is 8.8. Ea… |
CVE-2025-61881 | Medium | 5.9 | 2025-10-21 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.28, 21.3-21.19 and 23.4-23.9. Difficult to… |
CVE-2025-61763 | High | 8.1 | 2025-10-21 | Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.7.3.0.0. Easily exploitable vulnerability all… |
CVE-2025-61762 | Medium | 6.3 | 2025-10-21 | Vulnerability in the PeopleSoft Enterprise FIN Payables product of Oracle PeopleSoft (component: Payables). The supported version that is affected is 9.2. Ea… |
CVE-2025-61761 | Medium | 5.4 | 2025-10-21 | Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft (component: Work Order Management). The supported version… |
CVE-2025-61760 | High | 7.5 | 2025-10-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Diff… |
CVE-2025-61758 | Medium | 6.5 | 2025-10-21 | Vulnerability in the PeopleSoft Enterprise FIN IT Asset Management product of Oracle PeopleSoft (component: IT Asset Management). The supported version that… |
CVE-2025-61749 | Low | 2.7 | 2025-10-21 | Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are affected are 23.4-23.9. Easily exploitable vulnerability a… |
CVE-2025-61748 | Low | 3.7 | 2025-10-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported ver… |
CVE-2025-53071 | Medium | 4.3 | 2025-10-21 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Upload Attachments). Supported versions that are affected ar… |
CVE-2025-53064 | Medium | 4.3 | 2025-10-21 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 1… |
CVE-2025-53061 | Medium | 5.5 | 2025-10-21 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Supported versions that are affected are… |
CVE-2025-53060 | Medium | 6.1 | 2025-10-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0… |
CVE-2025-53059 | Medium | 4.9 | 2025-10-21 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch Dashboards). Supported versions that are affected a… |
CVE-2025-53058 | Medium | 6.1 | 2025-10-21 | Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Application Logging Interfaces). Supported versions that are a… |
CVE-2025-53057 | Medium | 5.9 | 2025-10-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported vers… |
CVE-2025-53052 | Medium | 6.1 | 2025-10-21 | Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12… |
CVE-2025-53049 | High | 8.4 | 2025-10-21 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Administration). Supported versions… |
CVE-2025-53041 | Medium | 6.1 | 2025-10-21 | Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Supported versions that are affected are 12.2.5-12.2.14. Eas… |
CVE-2025-53035 | Medium | 6.5 | 2025-10-21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform)… |
CVE-2025-52079 | High | 8.8 | 2025-10-21 | The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Change via crafted PO… |
CVE-2025-50075 | Medium | 6.5 | 2025-10-21 | Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Security Management… |
CVE-2025-60427 | Medium | 6.5 | 2025-10-21 | LibreTime 3.0.0-alpha.10 and possibly earlier is vulnerable to Broken Access Control, where a user with the DJ role can access analytics data via the Web UI an… |
CVE-2025-62510 | High | 8.1 | 2025-10-20 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In version 1.4.0, a regression allowed folder visibilit… |
CVE-2025-62509 | High | 8.1 | 2025-10-20 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to version 1.4.0, a business logic flaw in FileRi… |
CVE-2025-48025 | Medium | 4.3 | 2025-10-20 | In Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000, there is an improper access control vu… |
CVE-2025-56219 | High | 7.1 | 2025-10-20 | Incorrect access control in SigningHub v8.6.8 allows attackers to arbitrarily add user accounts without any rate limiting. This can lead to a resource exhausti… |
CVE-2025-11908 | Medium | 6.3 | 2025-10-17 | A security flaw has been discovered in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The affected element is the function uploadFile of the file /FileDir… |
CVE-2025-57567 | Critical | 9.1 | 2025-10-17 | A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme director… |
CVE-2025-11853 | Medium | 6.3 | 2025-10-16 | A vulnerability was determined in Sismics Teedy up to 1.11. This affects an unknown function of the file /api/file of the component API Endpoint. Executing a m… |
CVE-2025-53092 | Medium | 6.5 | 2025-10-16 | Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installat… |
CVE-2025-61543 | High | 7.1 | 2025-10-16 | A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4.0.2.2. The system uses `$_SERVER['HTTP_HOST']` directly to con… |
CVE-2025-61541 | High | 7.1 | 2025-10-16 | Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using… |
CVE-2025-9804 | Critical | 9.6 | 2025-10-16 | An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services an… |
CVE-2025-43313 | Medium | 5.5 | 2025-10-15 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be abl… |
CVE-2025-59494 | High | 7.8 | 2025-10-14 | Improper access control in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. |
CVE-2025-59253 | Medium | 5.5 | 2025-10-14 | Improper access control in Microsoft Windows Search Component allows an authorized attacker to deny service locally. |
CVE-2025-59230 | High | 7.8 | 2025-10-14 | Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. |
CVE-2025-59201 | High | 7.8 | 2025-10-14 | Improper access control in Network Connection Status Indicator (NCSI) allows an authorized attacker to elevate privileges locally. |
CVE-2025-59199 | High | 7.8 | 2025-10-14 | Improper access control in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally. |
CVE-2025-58726 | High | 7.5 | 2025-10-14 | Improper access control in Windows SMB Server allows an authorized attacker to elevate privileges over a network. |
CVE-2025-58724 | High | 7.8 | 2025-10-14 | Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally. |
CVE-2025-58714 | High | 7.8 | 2025-10-14 | Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-55694 | High | 7.8 | 2025-10-14 | Improper access control in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
CVE-2025-55240 | High | 7.3 | 2025-10-14 | Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally. |
CVE-2025-54603 | Medium | 6.5 | 2025-10-14 | An incorrect OIDC authentication flow in Claroty Secure Access 3.3.0 through 4.0.2 can result in unauthorized user creation or impersonation of existing OIDC u… |
CVE-2025-47989 | High | 7.0 | 2025-10-14 | Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally. |