CWE-284 · Improper Access Control (page 25)
Page 25 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-37143 | Medium | 4.9 | 2025-10-14 | An arbitrary file download vulnerability exists in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. S… |
CVE-2025-37142 | Medium | 4.9 | 2025-10-14 | Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation… |
CVE-2025-37141 | Medium | 4.9 | 2025-10-14 | Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation… |
CVE-2025-37140 | Medium | 4.9 | 2025-10-14 | Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation… |
CVE-2025-37137 | Medium | 6.5 | 2025-10-14 | Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation o… |
CVE-2025-37136 | Medium | 6.5 | 2025-10-14 | Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation o… |
CVE-2025-37135 | Medium | 6.5 | 2025-10-14 | Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation o… |
CVE-2025-25004 | High | 7.3 | 2025-10-14 | Improper access control in Microsoft PowerShell allows an authorized attacker to elevate privileges locally. |
CVE-2025-0033 | Medium | 6.0 | 2025-10-14 | Improper access control within AMD SEV-SNP could allow an admin privileged attacker to write to the RMP during SNP initialization, potentially resulting in a l… |
CVE-2025-11716 | Medium | 6.5 | 2025-10-14 | Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission. This vulnerability was fixed in Firefox 144 and Thu… |
CVE-2025-27258 | Critical | 9.8 | 2025-10-13 | Ericsson Network Manager (ENM) versions prior to ENM 25.1 GA contain a vulnerability, if exploited, can result in an escalation of privilege. |
CVE-2025-11660 | High | 7.3 | 2025-10-13 | A vulnerability has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this issue is some u… |
CVE-2025-11659 | High | 7.3 | 2025-10-13 | A flaw has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this vulnerability is an unkn… |
CVE-2025-11658 | High | 7.3 | 2025-10-13 | A vulnerability was detected in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected is an unknown function of… |
CVE-2025-11657 | High | 7.3 | 2025-10-13 | A security vulnerability has been detected in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This impacts an unkn… |
CVE-2025-11656 | High | 7.3 | 2025-10-13 | A weakness has been identified in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This affects an unknown function… |
CVE-2025-11655 | Medium | 4.7 | 2025-10-13 | A security flaw has been discovered in Total.js Flow up to 673ef9144dd25d4f4fd4fdfda5af27f230198924. The impacted element is an unknown function of the compone… |
CVE-2025-11647 | Low | 3.1 | 2025-10-12 | A flaw has been found in Tomofun Furbo 360 and Furbo Mini. This issue affects some unknown processing of the component GATT Service. This manipulation of the a… |
CVE-2025-11646 | Medium | 6.3 | 2025-10-12 | A vulnerability was detected in Tomofun Furbo 360 and Furbo Mini. This vulnerability affects unknown code of the component GATT Service. The manipulation resul… |
CVE-2025-11641 | Low | 3.9 | 2025-10-12 | A vulnerability was determined in Tomofun Furbo 360 and Furbo Mini. This impacts an unknown function of the component Trial Restriction Handler. This manipulat… |
CVE-2025-11634 | Low | 2.4 | 2025-10-12 | A security flaw has been discovered in Tomofun Furbo 360 and Furbo Mini. This affects an unknown part of the component UART Interface. The manipulation results… |
CVE-2025-62159 | | 2025-10-10 | External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. A vulnerability was discover… | |
CVE-2025-60306 | Critical | 9.9 | 2025-10-10 | code-projects Simple Car Rental System 1.0 has a permission bypass issue where low privilege users can forge high privilege sessions and perform sensitive oper… |
CVE-2025-60305 | High | 8.8 | 2025-10-10 | SourceCodester Online Student Clearance System 1.0 is vulnerable to Incorrect Access Control. The application contains a logic flaw which allows low privilege… |
CVE-2025-59218 | Critical | 9.6 | 2025-10-09 | Azure Entra ID Elevation of Privilege Vulnerability |
CVE-2025-45095 | High | 7.3 | 2025-10-09 | Lavasoft Web Companion (also known as Ad-Aware WebCompanion) versions 8.9.0.1091 through 12.1.3.1037 installs the DCIService.exe service with an unquoted servi… |
CVE-2025-11508 | Medium | 4.7 | 2025-10-08 | A security vulnerability has been detected in code-projects Voting System 1.0. This affects an unknown function of the file /admin/voters_add.php. Such manipul… |
CVE-2025-36636 | Medium | 4.3 | 2025-10-08 | In Tenable Security Center versions prior to 6.7.0, an improper access control vulnerability exists where an authenticated user could access areas outside of t… |
CVE-2025-11470 | Medium | 4.7 | 2025-10-08 | A security vulnerability has been detected in SourceCodester Hotel and Lodge Management System up to 1.0. The impacted element is an unknown function of the fi… |
CVE-2025-11440 | Medium | 4.3 | 2025-10-08 | A vulnerability was determined in JhumanJ OpnForm up to 1.9.3. Impacted is an unknown function of the file /edit. Executing manipulation can lead to improper a… |
CVE-2025-11436 | Medium | 6.3 | 2025-10-08 | A vulnerability was detected in JhumanJ OpnForm up to 1.9.3. Affected by this issue is some unknown functionality of the file /answer. The manipulation results… |
CVE-2025-11426 | Medium | 6.3 | 2025-10-08 | A security flaw has been discovered in projectworlds Advanced Library Management System 1.0. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-11417 | Medium | 6.3 | 2025-10-08 | A weakness has been identified in Campcodes Advanced Online Voting Management System 1.0. This vulnerability affects unknown code of the file /admin/voters_add… |
CVE-2025-11406 | Medium | 4.3 | 2025-10-07 | A security flaw has been discovered in kaifangqian kaifangqian-base up to 7b3faecda13848b3ced6c17c7423b76c5b47b8ab. This issue affects the function getAllUsers… |
CVE-2025-11398 | Medium | 6.3 | 2025-10-07 | A weakness has been identified in SourceCodester Hotel and Lodge Management System 1.0. The impacted element is an unknown function of the file /profile.php of… |
CVE-2025-11354 | Medium | 6.3 | 2025-10-07 | A flaw has been found in code-projects Online Hotel Reservation System 1.0. Affected is an unknown function of the file /admin/addslideexec.php. Executing mani… |
CVE-2025-11353 | Medium | 6.3 | 2025-10-07 | A vulnerability was detected in code-projects Online Hotel Reservation System 1.0. This impacts an unknown function of the file /admin/addgalleryexec.php. Perf… |
CVE-2025-11352 | Medium | 6.3 | 2025-10-07 | A security vulnerability has been detected in code-projects Online Hotel Reservation System 1.0. This affects an unknown function of the file /admin/addexec.ph… |
CVE-2025-11351 | Medium | 6.3 | 2025-10-07 | A weakness has been identified in code-projects Online Hotel Reservation System 1.0. The impacted element is an unknown function of the file /admin/editpicexec… |
CVE-2025-11347 | High | 7.3 | 2025-10-07 | A vulnerability was found in code-projects Student Crud Operation up to 3.3. This vulnerability affects the function move_uploaded_file of the file add.php of… |
CVE-2025-61777 | Critical | 9.4 | 2025-10-06 | Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/badge-templates` (GET) and `/api/admin/b… |
CVE-2025-57247 | Critical | 9.1 | 2025-10-06 | The BATBToken smart contract (address 0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2, Compiler Version v0.8.26+commit.8a97fa7a) contains incorrect access control i… |
CVE-2025-11320 | Medium | 6.3 | 2025-10-06 | A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4. Impacted is the function uploadFile of the file src/main/java/com/… |
CVE-2025-11318 | High | 7.3 | 2025-10-06 | A security flaw has been discovered in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This vulnerability affects unknown code of the file u… |
CVE-2025-11281 | Medium | 5.0 | 2025-10-05 | A vulnerability has been found in Frappe LMS 2.35.0. The affected element is an unknown function of the file /courses/ of the component Unpublished Course Hand… |
CVE-2025-59943 | High | 8.1 | 2025-10-03 | phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of email addresses during user registration… |
CVE-2025-59951 | Critical | 9.1 | 2025-10-01 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The official Docker image for Termix versions 1… |
CVE-2025-58055 | Medium | 4.3 | 2025-10-01 | Discourse is an open-source community discussion platform. In versions 3.5.0 and below, the Discourse AI suggestion endpoints for topic “Title”, “Category”, an… |
CVE-2025-20366 | Medium | 6.5 | 2025-10-01 | In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.111, 9.3.2408.119, and 9.2.2406.122, a low-privi… |
CVE-2023-50300 | Medium | 5.1 | 2025-10-01 | IBM Transformation Extender Advanced 10.0.1 could allow a local user to perform unauthorized actions due to improper access controls. |
CVE-2025-10847 | | 2025-10-01 | DX Unified Infrastructure Management (Nimsoft/UIM) and below contains an improper ACL handling vulnerability in the robot (controller) component. A remote atta… | |
CVE-2025-55797 | Medium | 6.5 | 2025-09-30 | An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/[schemaId] endpoint allows unauthenticated attackers to access historica… |
CVE-2025-11163 | Medium | 4.3 | 2025-09-30 | The SmartCrawl SEO checker, analyzer & optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t… |
CVE-2025-54875 | Critical | 9.8 | 2025-09-29 | FreshRSS is a free, self-hostable RSS aggregator. In versions 1.16.0 and above through 1.26.3, an unprivileged attacker can create a new admin user when regist… |
CVE-2025-57266 | Critical | 9.8 | 2025-09-29 | An issue was discovered in file AssistantController.java in ThriveX Blogging Framework 2.5.9 thru 3.1.3 allowing unauthenticated attackers to gain sensitive in… |
CVE-2025-54591 | High | 7.5 | 2025-09-29 | FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below expose information about feeds and tags of default admin users, due to lack of acce… |
CVE-2025-57197 | Medium | 6.0 | 2025-09-29 | In the Payeer Android application 2.5.0, an improper access control vulnerability exists in the authentication flow for the PIN change feature. A local attacke… |
CVE-2025-55795 | Low | 3.5 | 2025-09-29 | The openml/openml.org web application version v2.0.20241110 uses incremental user IDs and insufficient email ownership verification during email update workflo… |
CVE-2025-36351 | Medium | 4.3 | 2025-09-29 | IBM License Metric Tool 9.2.0 through 9.2.40 could allow an authenticated user to bypass access controls in the REST API interface and perform unauthorized a… |
CVE-2025-57428 | Medium | 6.5 | 2025-09-29 | Default credentials in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to gain access to the debug shell exposed via… |
CVE-2025-11136 | Medium | 4.7 | 2025-09-29 | A flaw has been found in YiFang CMS up to 2.0.2. The impacted element is the function webUploader of the file app/app/controller/File.php of the component Back… |
CVE-2025-11103 | Medium | 4.7 | 2025-09-28 | A security vulnerability has been detected in Projectworlds Online Tours and Travels 1.0. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2025-11078 | Medium | 6.3 | 2025-09-27 | A vulnerability was identified in itsourcecode Open Source Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/user/c… |
CVE-2025-59932 | High | 8.6 | 2025-09-27 | Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests w… |
CVE-2025-11028 | Medium | 5.3 | 2025-09-26 | A security flaw has been discovered in givanz Vvveb up to 1.0.7.2. This affects an unknown part of the component Image Handler. Performing manipulation results… |
CVE-2025-11026 | Low | 3.5 | 2025-09-26 | A vulnerability was determined in givanz Vvveb up to 1.0.7.2. Affected by this vulnerability is an unknown functionality of the component Configuration File Ha… |
CVE-2025-48707 | High | 7.5 | 2025-09-25 | An issue was discovered in Stormshield Network Security (SNS) before 5.0.1. TPM authentication information could, in some HA use cases, be shared among adminis… |
CVE-2025-10952 | Medium | 5.3 | 2025-09-25 | A security flaw has been discovered in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected by this issue is the function stream_handler o… |
CVE-2025-59422 | Low | 3.1 | 2025-09-25 | Dify is an open-source LLM app development platform. In version 1.8.1, a broken access control vulnerability on the /console/api/apps/<APP_ID>chat-messages?con… |
CVE-2025-10957 | | 2025-09-25 | This vulnerability exists in the Syrotech SY-GPON-2010-WADONT router due to improper access control in its FTP service. A remote attacker could exploit this vu… | |
CVE-2025-56241 | High | 7.5 | 2025-09-24 | Aztech DSL5005EN firmware 1.00.AZ_2013-05-10 and possibly other versions allows unauthenticated attackers to change the administrator password via a crafted PO… |
CVE-2025-48869 | High | 7.5 | 2025-09-24 | Horilla is a free and open source Human Resource Management System (HRMS). Unauthenticated users can access uploaded resume files in Horilla 1.3.0 by directly… |
CVE-2025-20316 | Medium | 5.3 | 2025-09-24 | A vulnerability in the access control list (ACL) programming of Cisco IOS XE Software for Cisco Catalyst 9500X and 9600X Series Switches could allow an unauthe… |
CVE-2025-20339 | Medium | 5.8 | 2025-09-24 | A vulnerability in the access control list (ACL) processing of IPv4 packets of Cisco SD-WAN vEdge Software could allow an unauthenticated, remote attacker to b… |
CVE-2025-7106 | Medium | 5.3 | 2025-09-23 | danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. The `checkAccess` function in `api/server/mid… |
CVE-2025-59434 | Critical | 9.6 | 2025-09-22 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to August 2025 Cloud-Hosted Flowise, an authenticated vulnerabil… |
CVE-2025-57438 | Medium | 6.8 | 2025-09-22 | The 2wcom IP-4c 2.15.5 device suffers from a Broken Access Control vulnerability. Certain sensitive endpoints are intended to be accessible only after the admi… |
CVE-2025-5962 | High | 7.7 | 2025-09-22 | A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of… |
CVE-2025-10763 | Medium | 6.3 | 2025-09-21 | A vulnerability was determined in academico-sis academico up to d9a9e2636fbf7e5845ee086bcb03ca62faceb6ab. Affected by this issue is some unknown functionality… |
CVE-2025-10755 | Medium | 6.3 | 2025-09-20 | A vulnerability was detected in Selleo Mentingo 2025.08.27. The impacted element is an unknown function of the component Content-Type Handler. The manipulation… |
CVE-2025-10741 | Medium | 6.3 | 2025-09-20 | A security vulnerability has been detected in Selleo Mentingo up to 2025.08.27. The affected element is an unknown function of the component Profile Picture Ha… |
CVE-2025-10669 | Medium | 6.3 | 2025-09-18 | A vulnerability was detected in Airsonic-Advanced up to 10.6.0. This vulnerability affects unknown code of the component Playlist Upload Handler. Performing ma… |
CVE-2025-23329 | High | 7.5 | 2025-09-17 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause memory corruption by identifying and accessing the… |
CVE-2025-10616 | Medium | 6.3 | 2025-09-17 | A security flaw has been discovered in itsourcecode E-Commerce Website 1.0. Affected is an unknown function of the file /admin/users.php. The manipulation resu… |
CVE-2025-10615 | Medium | 6.3 | 2025-09-17 | A vulnerability was identified in itsourcecode E-Commerce Website 1.0. This impacts an unknown function of the file /admin/products.php. The manipulation leads… |
CVE-2025-10608 | Medium | 6.3 | 2025-09-17 | A vulnerability was detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /enrollment-history/. Performing manipu… |
CVE-2025-10607 | Medium | 4.3 | 2025-09-17 | A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Avaliacao/diarioApi. Such man… |
CVE-2025-10600 | High | 7.3 | 2025-09-17 | A flaw has been found in SourceCodester Online Exam Form Submission 1.0. This impacts an unknown function of the file /register.php. This manipulation of the a… |
CVE-2025-37131 | Medium | 4.9 | 2025-09-16 | A vulnerability in EdgeConnect SD-WAN ECOS could allow an authenticated remote threat actor with admin privileges to access sensitive unauthorized system files… |
CVE-2025-37125 | High | 7.5 | 2025-09-16 | A broken access control vulnerability exists in HPE Aruba Networking EdgeConnect OS (ECOS). Successful exploitation could allow an attacker to bypass firewall… |
CVE-2025-54391 | Critical | 9.1 | 2025-09-16 | A vulnerability in the EnableTwoFactorAuthRequest SOAP endpoint of Zimbra Collaboration (ZCS) allows an attacker with valid user credentials to bypass Two-Fact… |
CVE-2025-59333 | High | 8.1 | 2025-09-16 | The mcp-database-server (MCP Server) 1.1.0 and earlier, as distributed via the npm package @executeautomation/database-server, fails to implement adequate secu… |
CVE-2025-43371 | High | 8.2 | 2025-09-15 | This issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to break out of its sandbox. |
CVE-2025-43369 | Medium | 5.5 | 2025-09-15 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Tahoe 26. An app may be able to access protected user data. |
CVE-2025-43340 | High | 7.8 | 2025-09-15 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to break out of its sandbox. |
CVE-2025-43337 | Medium | 5.5 | 2025-09-15 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26. An app may be able to access s… |
CVE-2025-43332 | Medium | 5.2 | 2025-09-15 | A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able… |
CVE-2025-43328 | Low | 3.3 | 2025-09-15 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data. |
CVE-2025-43325 | Medium | 5.5 | 2025-09-15 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data. |
CVE-2025-43321 | Medium | 5.5 | 2025-09-15 | The issue was resolved by blocking unsigned services from launching on Intel Macs. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26… |