CWE-284 · Improper Access Control (page 26)
Page 26 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-43319 | Medium | 5.5 | 2025-09-15 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to a… |
CVE-2025-43317 | Medium | 5.5 | 2025-09-15 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26… |
CVE-2025-43315 | Medium | 5.5 | 2025-09-15 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to a… |
CVE-2025-43308 | Medium | 5.3 | 2025-09-15 | This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able t… |
CVE-2025-43305 | Medium | 5.5 | 2025-09-15 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. A malicious app may be able to… |
CVE-2025-43294 | Low | 3.3 | 2025-09-15 | An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 26.1 and iPadOS 26.1… |
CVE-2025-43291 | Medium | 5.5 | 2025-09-15 | A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be… |
CVE-2025-43285 | Medium | 5.5 | 2025-09-15 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be abl… |
CVE-2025-43263 | High | 7.1 | 2025-09-15 | The issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to read and write files outside of its sandbox. |
CVE-2025-43208 | Medium | 5.5 | 2025-09-15 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to read sensitive location informatio… |
CVE-2025-43207 | Medium | 5.5 | 2025-09-15 | This issue was addressed with improved entitlements. This issue is fixed in macOS Tahoe 26. An app may be able to access user-sensitive data. |
CVE-2025-43204 | High | 7.8 | 2025-09-15 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26. An app may be able to break out of its sandbox. |
CVE-2025-31270 | Medium | 5.5 | 2025-09-15 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to access protected user data. |
CVE-2025-31269 | Medium | 5.5 | 2025-09-15 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to access protecte… |
CVE-2025-31268 | Medium | 5.5 | 2025-09-15 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be abl… |
CVE-2025-24197 | Medium | 5.5 | 2025-09-15 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to access se… |
CVE-2025-24088 | High | 7.5 | 2025-09-15 | The issue was addressed by adding additional logic. This issue is fixed in macOS Tahoe 26. An app may be able to override MDM-enforced settings from profiles. |
CVE-2025-56274 | High | 8.1 | 2025-09-15 | SourceCodester Web-based Pharmacy Product Management System 1.0 is vulnerable to Incorrect Access Control, which allows low-privileged users to forge high priv… |
CVE-2025-10480 | Medium | 6.3 | 2025-09-15 | A weakness has been identified in SourceCodester Online Student File Management System 1.0. This affects an unknown function of the file /save_file.php. Execut… |
CVE-2025-10491 | High | 7.8 | 2025-09-15 | The MongoDB Windows installation MSI may leave ACLs unset on custom installation directories allowing a local attacker to introduce executable code to MongoDB'… |
CVE-2025-10447 | High | 7.3 | 2025-09-15 | A vulnerability was detected in Campcodes Online Job Finder System 1.0. The impacted element is an unknown function of the file /eris/applicationform.php. The… |
CVE-2025-10428 | Medium | 6.3 | 2025-09-15 | A security vulnerability has been detected in SourceCodester Pet Grooming Management Software 1.0. Affected is an unknown function of the file /admin/seo_setti… |
CVE-2025-10427 | Medium | 6.3 | 2025-09-15 | A weakness has been identified in SourceCodester Pet Grooming Management Software 1.0. This impacts an unknown function of the file /admin/operation/user.php… |
CVE-2025-10425 | High | 7.3 | 2025-09-15 | A vulnerability was identified in 1000projects Online Student Project Report Submission and Evaluation System 1.0. The impacted element is an unknown function… |
CVE-2025-10424 | High | 7.3 | 2025-09-15 | A vulnerability was determined in 1000projects Online Student Project Report Submission and Evaluation System 1.0. The affected element is an unknown function… |
CVE-2025-10398 | Medium | 6.3 | 2025-09-14 | A security flaw has been discovered in fcba_zzm ics-park Smart Park Management System 2.0. This vulnerability affects unknown code of the file FileUploadUtils… |
CVE-2025-10371 | High | 7.3 | 2025-09-13 | A security flaw has been discovered in eCharge Hardy Barth Salia PLCC up to 2.3.81. This issue affects some unknown processing of the file /api.php. The manipu… |
CVE-2025-45584 | High | 7.5 | 2025-09-12 | Incorrect access control in the web service of Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to download car information without authentication. |
CVE-2025-10321 | Medium | 5.3 | 2025-09-12 | A flaw has been found in Wavlink WL-WN578W2 221110. Impacted is an unknown function of the file /live_online.shtml. Executing manipulation can lead to informat… |
CVE-2024-45432 | High | 7.5 | 2025-09-12 | OpenSynergy BlueSDK (aka Blue SDK) through 6.x mishandles a function call. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results from… |
CVE-2025-27238 | Low | 3.5 | 2025-09-12 | Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them. |
CVE-2025-10247 | Medium | 6.3 | 2025-09-11 | A security vulnerability has been detected in JEPaaS 7.2.8. This vulnerability affects the function doFilterInternal of the component Filter Handler. Such mani… |
CVE-2025-10201 | High | 8.8 | 2025-09-10 | Inappropriate implementation in Mojo in Google Chrome on Android, Linux, ChromeOS prior to 140.0.7339.127 allowed a remote attacker to bypass site isolation vi… |
CVE-2025-20159 | Medium | 5.3 | 2025-09-10 | A vulnerability in the management interface access control list (ACL) processing feature in Cisco IOS XR Software could allow an unauthenticated, remote attack… |
CVE-2025-56406 | High | 7.5 | 2025-09-10 | An issue was discovered in mcp-neo4j 0.3.0 allowing attackers to obtain sensitive information or execute arbitrary commands via the SSE service. NOTE: the Supp… |
CVE-2025-56405 | High | 7.5 | 2025-09-10 | An issue was discovered in litmusautomation litmus-mcp-server thru 0.0.1 allowing unauthorized attackers to control the target's MCP service through the SSE pr… |
CVE-2025-54116 | High | 7.3 | 2025-09-09 | Improper access control in Windows MultiPoint Services allows an authorized attacker to elevate privileges locally. |
CVE-2025-54098 | High | 7.8 | 2025-09-09 | Improper access control in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
CVE-2025-49692 | High | 7.8 | 2025-09-09 | Improper access control in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally. |
CVE-2025-10116 | High | 7.3 | 2025-09-09 | A vulnerability was identified in SiempreCMS up to 1.3.6. This vulnerability affects unknown code of the file /docs/admin/file_upload.php. Such manipulation le… |
CVE-2025-58752 | Medium | 5.3 | 2025-09-08 | Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of… |
CVE-2025-58751 | Medium | 5.3 | 2025-09-08 | Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public direc… |
CVE-2025-10093 | Medium | 5.3 | 2025-09-08 | A vulnerability was identified in D-Link DIR-852 up to 1.00CN B09. Affected by this vulnerability is the function phpcgi_main of the file /getcfg.php of the co… |
CVE-2025-10085 | Medium | 6.3 | 2025-09-08 | A security flaw has been discovered in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file manage_website… |
CVE-2025-10083 | Medium | 6.3 | 2025-09-08 | A vulnerability was determined in SourceCodester Pet Grooming Management Software 1.0. Affected by this issue is some unknown functionality of the file /admin/… |
CVE-2025-10081 | Medium | 4.7 | 2025-09-08 | A flaw has been found in SourceCodester Pet Management System 1.0. This impacts an unknown function of the file /admin/profile.php. This manipulation of the ar… |
CVE-2025-10072 | Medium | 6.3 | 2025-09-07 | A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /matricula/[ID_STUDENT]/enturmar/. Performi… |
CVE-2025-10071 | Medium | 6.3 | 2025-09-07 | A vulnerability has been found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /cancelar-enturmacao-em-lote/. Such manip… |
CVE-2025-10070 | Medium | 6.3 | 2025-09-07 | A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /enturmacao-em-lote/. This manipulation causes improper acces… |
CVE-2025-53791 | Medium | 4.7 | 2025-09-05 | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2025-10013 | Medium | 6.3 | 2025-09-05 | A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /exportacao-para-o-seb. Performing manipulation re… |
CVE-2025-55244 | Critical | 9.0 | 2025-09-04 | Azure Bot Service Elevation of Privilege Vulnerability |
CVE-2025-55238 | High | 7.5 | 2025-09-04 | Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability |
CVE-2025-54914 | Critical | 10.0 | 2025-09-04 | Azure Networking Elevation of Privilege Vulnerability |
CVE-2025-26424 | Medium | 4.0 | 2025-09-04 | In multiple functions of VpnManager.java, there is a possible cross-user data leak due to a logic error in the code. This could lead to local information discl… |
CVE-2025-9942 | Medium | 6.3 | 2025-09-04 | A vulnerability has been found in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /submitproperty.php. The manipulatio… |
CVE-2025-9941 | Medium | 6.3 | 2025-09-04 | A flaw has been found in CodeAstro Real Estate Management System 1.0. This impacts an unknown function of the file /register.php. Executing manipulation of the… |
CVE-2025-36909 | Medium | 5.3 | 2025-09-04 | Information disclosure |
CVE-2025-20335 | Medium | 5.3 | 2025-09-03 | A vulnerability in the directory permissions of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an un… |
CVE-2025-58459 | Medium | 4.3 | 2025-09-03 | Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/… |
CVE-2025-21031 | Medium | 6.8 | 2025-09-03 | Improper access control in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to use the privileged APIs. |
CVE-2025-9847 | Medium | 6.3 | 2025-09-03 | A weakness has been identified in ScriptAndTools Real Estate Management System 1.0. Impacted is an unknown function of the file register.php. This manipulation… |
CVE-2025-9843 | Medium | 5.3 | 2025-09-03 | A flaw has been found in Das Parking Management System 停车场管理系统 6.2.0. Affected is an unknown function of the file /Operator/FindAll. This manipulation causes i… |
CVE-2025-9842 | Medium | 5.3 | 2025-09-03 | A vulnerability was detected in Das Parking Management System 停车场管理系统 6.2.0. This impacts an unknown function of the file /Operator/Search. The manipulation re… |
CVE-2025-9841 | Medium | 6.3 | 2025-09-03 | A security vulnerability has been detected in code-projects Mobile Shop Management System 1.0. This affects an unknown function of the file AddNewProduct.php… |
CVE-2025-55373 | Medium | 5.3 | 2025-09-02 | Incorrect access control in Beakon Application before v5.4.3 allows authenticated attackers with low-level privileges to escalate privileges and execute comman… |
CVE-2025-54599 | High | 7.5 | 2025-09-02 | The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows account takeover, if SSO is used, when a victim changes… |
CVE-2025-9800 | Medium | 6.3 | 2025-09-01 | A weakness has been identified in SimStudioAI sim up to ed9b9ad83f1a7c61f4392787fb51837d34eeb0af. Affected by this issue is the function Import of the file app… |
CVE-2025-9795 | Medium | 6.3 | 2025-09-01 | A vulnerability has been found in xujeff tianti 天梯 up to 2.3. The impacted element is the function ajaxUploadFile of the file src/main/java/com/jeff/tianti/con… |
CVE-2025-9775 | High | 7.3 | 2025-09-01 | A vulnerability was found in RemoteClinic up to 2.0. Impacted is an unknown function of the file /staff/edit-my-profile.php. The manipulation of the argument i… |
CVE-2025-9774 | Medium | 4.3 | 2025-09-01 | A vulnerability has been found in RemoteClinic up to 2.0. This issue affects some unknown processing of the file /patients/edit-patient.php. The manipulation o… |
CVE-2025-9772 | High | 7.3 | 2025-09-01 | A vulnerability was detected in RemoteClinic up to 2.0. This affects an unknown part of the file /staff/edit.php. Performing manipulation of the argument image… |
CVE-2024-46916 | High | 8.1 | 2025-08-29 | Diebold Nixdorf Vynamic Security Suite through 4.3.0 SR06 contains functionality that allows the removal of critical system files before the filesystem is prop… |
CVE-2025-39247 | High | 8.6 | 2025-08-29 | There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated user to obtain the admin permission. |
CVE-2024-44271 | Low | 3.3 | 2025-08-29 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2. An app may be able to record the screen without an indicator. |
CVE-2025-57219 | Medium | 5.3 | 2025-08-28 | Incorrect access control in the endpoint /goform/ate of Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 allows attackers to escalate privileges or access sen… |
CVE-2025-57758 | Medium | 4.3 | 2025-08-28 | Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is… |
CVE-2025-25734 | Medium | 6.8 | 2025-08-26 | Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 was discovered to contain an unauthenticated EFI… |
CVE-2025-9476 | High | 7.3 | 2025-08-26 | A vulnerability has been found in SourceCodester Human Resource Information System 1.0. Affected by this issue is some unknown functionality of the file /Super… |
CVE-2025-9475 | High | 7.3 | 2025-08-26 | A flaw has been found in SourceCodester Human Resource Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /Admin_Da… |
CVE-2025-9461 | Medium | 4.3 | 2025-08-26 | A weakness has been identified in diyhi bbs up to 6.8. The impacted element is an unknown function of the file src/main/java/cms/web/action/filePackage/FilePac… |
CVE-2025-9415 | Medium | 6.3 | 2025-08-25 | A vulnerability was identified in GreenCMS up to 2.3.0603. This affects an unknown part of the file /index.php?m=admin&c=media&a=fileconnect. The manipulation… |
CVE-2025-29421 | High | 7.5 | 2025-08-25 | PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the getThemeFileContent function. |
CVE-2025-50900 | Critical | 9.8 | 2025-08-25 | An issue was discovered in getrebuild/rebuild 4.0.4. The affected source code class is com.rebuild.web.RebuildWebInterceptor, and the affected function is preH… |
CVE-2025-44178 | Medium | 6.5 | 2025-08-25 | DASAN GPON ONU H660WM H660WMR210825 is susceptible to improper access control under its default settings. Attackers can exploit this vulnerability to gain unau… |
CVE-2025-29524 | Medium | 6.5 | 2025-08-25 | Incorrect access control in the component /cgi-bin/system_diagnostic_main.asp of DASAN GPON ONU H660WM H660WMR210825 allows attackers to access sensitive infor… |
CVE-2025-29520 | Medium | 5.3 | 2025-08-25 | Incorrect access control in the Maintenance module of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows authenticated attackers with low-level p… |
CVE-2024-46412 | Medium | 6.5 | 2025-08-25 | Incorrect access control in the prehandle function of Rebuild v3.7.7 allows attackers to bypass authentication via a crafted GET request sent to /commons/ip-lo… |
CVE-2025-29515 | Critical | 9.8 | 2025-08-25 | Incorrect access control in the DELT_file.xgi endpoint of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to modify arbitrary settin… |
CVE-2025-29514 | Critical | 9.8 | 2025-08-25 | Incorrect access control in the config.xgi function of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to download the configuration… |
CVE-2025-9406 | Medium | 6.3 | 2025-08-25 | A weakness has been identified in xuhuisheng lemon up to 1.13.0. This affects the function uploadImage of the file CmsArticleController.java of the component c… |
CVE-2025-9400 | Medium | 6.3 | 2025-08-25 | A flaw has been found in YiFang CMS up to 2.0.5. This affects the function mergeMultipartUpload of the file app/utils/base/plugin/P_file.php. This manipulation… |
CVE-2025-9398 | Medium | 5.3 | 2025-08-25 | A security vulnerability has been detected in YiFang CMS up to 2.0.5. Affected by this vulnerability is the function exportInstallTable of the file app/utils/b… |
CVE-2025-9397 | Medium | 6.3 | 2025-08-24 | A weakness has been identified in givanz Vvveb up to 1.0.7.2. Affected is an unknown function of the file /system/traits/media.php. Executing manipulation of t… |
CVE-2025-9381 | Low | 1.6 | 2025-08-24 | A security flaw has been discovered in FNKvision Y215 CCTV Camera 10.194.120.40. This affects an unknown part of the file /tmp/wpa_supplicant.conf. Performing… |
CVE-2022-43110 | Critical | 9.8 | 2025-08-22 | Voltronic Power ViewPower through 1.04-21353 and PowerShield Netguard before 1.04-23292 allows a remote attacker to configure the system via an unspecified web… |
CVE-2024-53496 | Critical | 9.8 | 2025-08-22 | Incorrect access control in the doFilter function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication. |
CVE-2025-55630 | High | 7.3 | 2025-08-22 | A discrepancy in the error message returned by the login function of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_250312228… |
CVE-2025-55626 | Medium | 5.3 | 2025-08-22 | An Insecure Direct Object Reference (IDOR) vulnerability in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allows… |
CVE-2024-53494 | High | 7.5 | 2025-08-22 | Incorrect access control in the preHandle function of SpringBootBlog v1.0.0 allows attackers to access sensitive components without authentication. |