CWE-284 · Improper Access Control (page 27)
Page 27 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-55741 | High | 8.1 | 2025-08-22 | UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. In versions 0.3.0 and earlier, users without the Delete pr… |
CVE-2025-53763 | Critical | 9.8 | 2025-08-21 | Improper access control in Azure Databricks allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-7051 | High | 8.3 | 2025-08-21 | On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerabil… |
CVE-2024-45438 | Critical | 9.1 | 2025-08-21 | An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14. The file quarantine.php within the SpamTi… |
CVE-2025-55371 | Medium | 5.3 | 2025-08-21 | Incorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows unauthorized attackers to obtain all the information of the h… |
CVE-2025-55368 | High | 8.8 | 2025-08-21 | Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier statu… |
CVE-2025-55367 | Medium | 5.3 | 2025-08-21 | Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier s… |
CVE-2025-55366 | Medium | 5.3 | 2025-08-21 | Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execu… |
CVE-2025-9296 | Medium | 4.7 | 2025-08-21 | A security vulnerability has been detected in Emlog Pro up to 2.5.18. This affects an unknown function of the file /admin/blogger.php?action=update_avatar. Suc… |
CVE-2025-27215 | High | 8.1 | 2025-08-21 | An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect Display Cast devices to make unsupported changes to… |
CVE-2024-57155 | Critical | 9.8 | 2025-08-20 | Incorrect access control in radar v1.0.8 allows attackers to bypass authentication and access sensitive APIs without a token. |
CVE-2024-57154 | Critical | 9.8 | 2025-08-20 | Incorrect access control in dts-shop v0.0.1-SNAPSHOT allows attackers to bypass authentication via sending a crafted payload to /admin/auth/index. |
CVE-2025-9240 | Medium | 4.3 | 2025-08-20 | A security flaw has been discovered in elunez eladmin up to 2.7. Affected by this issue is some unknown functionality of the file /auth/info. The manipulation… |
CVE-2024-57152 | High | 7.5 | 2025-08-20 | Incorrect access control in the preHandle function of my-site v1.0.2 allows attackers to access sensitive components without authentication via the cn.luischen… |
CVE-2024-53495 | High | 7.5 | 2025-08-20 | Incorrect access control in the preHandle function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication. |
CVE-2025-28041 | High | 8.6 | 2025-08-20 | Incorrect access control in the doFilter function of itranswarp up to 2.19 allows attackers to access sensitive components without authentication. |
CVE-2025-20131 | Medium | 4.9 | 2025-08-20 | A vulnerability in the GUI of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative privileges to upload files… |
CVE-2024-57157 | Critical | 9.8 | 2025-08-20 | Incorrect access control in Jantent v1.1 allows attackers to bypass authentication and access sensitive APIs without a token. |
CVE-2025-9153 | Medium | 6.3 | 2025-08-19 | A vulnerability was detected in itsourcecode Online Tour and Travel Management System 1.0. This vulnerability affects unknown code of the file /admin/operation… |
CVE-2025-51539 | Medium | 5.3 | 2025-08-19 | EzGED3 3.5.0 contains an unauthenticated arbitrary file read vulnerability due to improper access control and insufficient input validation in a script exposed… |
CVE-2025-50434 | Medium | 5.3 | 2025-08-19 | A security issue has been identified in Appian Enterprise Business Process Management version 25.3. The vulnerability is related to incorrect access control, w… |
CVE-2025-51529 | Medium | 5.3 | 2025-08-19 | Incorrect Access Control in the AJAX endpoint functionality in jonkastonka Cookies and Content Security Policy plugin through version 2.29 allows remote attack… |
CVE-2025-50897 | Medium | 4.3 | 2025-08-19 | A vulnerability exists in riscv-boom SonicBOOM 1.2 (BOOMv1.2) processor implementation, where valid virtual-to-physical address translations configured with wr… |
CVE-2025-9139 | Medium | 4.3 | 2025-08-19 | A vulnerability was determined in Scada-LTS 2.7.8.1. Affected by this vulnerability is an unknown functionality of the file /Scada-LTS/dwr/call/plaincall/Watch… |
CVE-2025-32992 | High | 8.5 | 2025-08-18 | Thermo Fisher Scientific ePort through 3.0.0 has Incorrect Access Control. |
CVE-2025-4962 | High | 7.7 | 2025-08-18 | An Insecure Direct Object Reference (IDOR) vulnerability was identified in the `POST /v1/templates` endpoint of the Lunary API, affecting versions up to 0.8.8… |
CVE-2025-9099 | Medium | 6.3 | 2025-08-18 | A vulnerability was identified in Acrel Environmental Monitoring Cloud Platform up to 20250804. This affects an unknown part of the file /NewsManage/UploadNews… |
CVE-2017-20199 | Low | 3.1 | 2025-08-16 | A vulnerability was found in Buttercup buttercup-browser-extension up to 0.14.2. Affected by this vulnerability is an unknown functionality of the component Va… |
CVE-2025-50861 | Medium | 6.5 | 2025-08-14 | The Lotus Cars Android app (com.lotus.carsdomestic.intl) 1.2.8 contains an exported component, PushDeepLinkActivity, which is accessible without authentication… |
CVE-2025-20219 | Medium | 5.3 | 2025-08-14 | A vulnerability in the implementation of access control rules for loopback interfaces in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and C… |
CVE-2025-8965 | Medium | 6.3 | 2025-08-14 | A vulnerability has been found in linlinjava litemall up to 1.8.0. This vulnerability affects the function create of the file litemall-admin-api/src/main/java/… |
CVE-2025-48861 | Medium | 5.3 | 2025-08-14 | A vulnerability in the Task API endpoint of the ctrlX OS setup mechanism allowed a remote, unauthenticated attacker to access and extract internal application… |
CVE-2025-48860 | High | 8.0 | 2025-08-14 | A vulnerability in the web application of the ctrlX OS setup mechanism facilitated an authenticated (low privileged) attacker to gain remote access to backup a… |
CVE-2025-55196 | | 2025-08-13 | External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability wa… | |
CVE-2025-8762 | Medium | 6.8 | 2025-08-13 | A vulnerability was found in INSTAR 2K+ and 4K 3.11.1 Build 1124. This issue affects some unknown processing of the component UART Interface. The manipulation… |
CVE-2025-53729 | High | 7.8 | 2025-08-12 | Improper access control in Azure File Sync allows an authorized attacker to elevate privileges locally. |
CVE-2025-49707 | High | 7.9 | 2025-08-12 | Improper access control in Azure Virtual Machines allows an authorized attacker to perform spoofing locally. |
CVE-2025-24999 | High | 8.8 | 2025-08-12 | Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network. |
CVE-2025-24840 | Medium | 5.8 | 2025-08-12 | Improper access control for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an unauthenticated user to po… |
CVE-2025-24323 | Medium | 6.5 | 2025-08-12 | Improper access control in some firmware package and LED mode toggle tool for some Intel(R) PCIe Switch software before version MR4_1.0b1 may allow a privilege… |
CVE-2025-24313 | Medium | 4.4 | 2025-08-12 | Improper access control for some Device Plugins for Kubernetes software maintained by Intel before version 0.32.0 may allow a privileged user to potentially en… |
CVE-2025-20099 | Medium | 6.7 | 2025-08-12 | Improper access control for some Intel(R) Rapid Storage Technology installation software may allow an authenticated user to potentially enable escalation of pr… |
CVE-2025-55012 | | 2025-08-11 | Zed is a multiplayer code editor. Prior to version 0.197.3, in the Zed Agent Panel allowed for an AI agent to achieve Remote Code Execution (RCE) by bypassing… | |
CVE-2025-8859 | Medium | 6.3 | 2025-08-11 | A vulnerability was identified in code-projects eBlog Site 1.0. Affected by this vulnerability is an unknown functionality of the file /native/admin/save-slide… |
CVE-2025-8841 | Medium | 6.3 | 2025-08-11 | A vulnerability was identified in zlt2000 microservices-platform up to 6.0.0. Affected by this vulnerability is the function Upload of the file zlt-business/fi… |
CVE-2025-8798 | High | 7.3 | 2025-08-10 | A vulnerability was found in oitcode samarium up to 0.9.6. It has been classified as critical. Affected is an unknown function of the file /dashboard/product o… |
CVE-2025-8795 | Medium | 6.3 | 2025-08-10 | A vulnerability, which was classified as critical, was found in LitmusChaos Litmus up to 3.19.0. This affects an unknown part of the file /auth/login. The mani… |
CVE-2025-8775 | Medium | 6.3 | 2025-08-09 | A vulnerability was found in Qiyuesuo Eelectronic Signature Platform up to 4.34 and classified as critical. Affected by this issue is the function execute of t… |
CVE-2025-8764 | Medium | 6.3 | 2025-08-09 | A vulnerability classified as critical has been found in linlinjava litemall up to 1.8.0. Affected is the function Upload of the file /wx/storage/upload. The m… |
CVE-2025-8738 | Medium | 5.3 | 2025-08-08 | A vulnerability has been found in zlt2000 microservices-platform up to 6.0.0 and classified as problematic. This vulnerability affects unknown code of the file… |
CVE-2025-54397 | Medium | 4.3 | 2025-08-07 | Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 inserts Sensitive Information Into Sent Data to authenticated users. |
CVE-2024-42048 | Medium | 6.5 | 2025-08-07 | OpenOrange Business Framework version 1.15.5 installs to a directory with overly permissive access control, allowing all authenticated users to write to the in… |
CVE-2025-54786 | Medium | 5.3 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authenticati… |
CVE-2025-51054 | Medium | 6.5 | 2025-08-06 | Vedo Suite 2024.17 is vulnerable to Incorrect Access Control, which allows remote attackers to obtain a valid high privilege JWT token without prior authentica… |
CVE-2024-55402 | Medium | 5.3 | 2025-08-06 | 4C Strategies Exonaut before v22.4 was discovered to contain an access control issue. |
CVE-2025-30127 | Critical | 9.8 | 2025-08-06 | An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. Once access is gained either by default, common, or cracked passwords, the video recordings… |
CVE-2025-51532 | High | 7.5 | 2025-08-06 | Incorrect access control in Sage DPW 2024_12_004 and earlier allows unauthorized attackers to access the built-in Database Monitor via a crafted request. The v… |
CVE-2025-46391 | Medium | 6.5 | 2025-08-06 | CWE-284: Improper Access Control |
CVE-2025-27062 | High | 7.8 | 2025-08-06 | Memory corruption while handling client exceptions, allowing unauthorized channel access. |
CVE-2025-51627 | Medium | 6.5 | 2025-08-05 | Incorrect access control in CaricaVerbale in Agenzia Impresa Eccobook v2.81.1 allows authenticated attackers with low-level access to escalate privileges to Ad… |
CVE-2025-51060 | Medium | 6.5 | 2025-08-05 | An issue was discovered in CPUID cpuz.sys 1.0.5.4. An attacker can use DeviceIoControl with the unvalidated parameters 0x9C402440 and 0x9C402444 as IoControlCo… |
CVE-2025-43980 | Medium | 6.5 | 2025-08-05 | An issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN. They enable the SSH service by default with the credentials of root/admin. The GUI does… |
CVE-2025-54871 | Medium | 5.5 | 2025-08-05 | Electron Capture facilitates video playback for screen-sharing and capture. In versions 2.19.1 and below, the elecap app on macOS allows local unprivileged use… |
CVE-2025-8526 | Medium | 6.3 | 2025-08-04 | A vulnerability was found in Exrick xboot up to 3.3.4. It has been declared as critical. This vulnerability affects the function Upload of the file xboot-fast/… |
CVE-2025-8525 | Medium | 5.3 | 2025-08-04 | A vulnerability was found in Exrick xboot up to 3.3.4. It has been classified as problematic. This affects an unknown part of the component Spring Boot Admin/S… |
CVE-2025-8519 | Low | 2.7 | 2025-08-04 | A vulnerability classified as problematic has been found in givanz Vvveb up to 1.0.5. This affects an unknown part of the file /vadmin123/index.php?module=edit… |
CVE-2025-8515 | Low | 3.1 | 2025-08-04 | A weakness has been identified in Intelbras InControl 2.21.60.9. This vulnerability affects unknown code of the file /v1/operador/ of the component JSON Endpoi… |
CVE-2025-8504 | Medium | 6.3 | 2025-08-03 | A vulnerability, which was classified as critical, was found in code-projects Kitchen Treasure 1.0. This affects an unknown part of the file /userregistration… |
CVE-2025-23277 | High | 7.3 | 2025-08-02 | NVIDIA Display Driver for Linux and Windows contains a vulnerability in the kernel mode driver, where an attacker could access memory outside bounds permitted… |
CVE-2025-50870 | Critical | 9.8 | 2025-08-01 | Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint. The myds GET parameter accepts an email addre… |
CVE-2025-26062 | Critical | 9.8 | 2025-07-31 | An access control issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to access the router's settings file and obtain potentia… |
CVE-2025-50850 | High | 8.6 | 2025-07-31 | An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such as CAPTCHA verification and rate limitin… |
CVE-2025-29556 | High | 7.3 | 2025-07-31 | ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control. Since version 6.3, ExaGrid enforces restrictions preventing users with the Admin role f… |
CVE-2025-52289 | High | 8.0 | 2025-07-31 | A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbi… |
CVE-2025-29557 | Medium | 5.4 | 2025-07-31 | ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control in the MailConfiguration API endpoint, where users with operator-level privileges can is… |
CVE-2025-8379 | Medium | 4.7 | 2025-07-31 | A vulnerability classified as critical has been found in Campcodes Online Hotel Reservation System 1.0. This affects an unknown part of the file /admin/edit_ro… |
CVE-2025-8344 | Medium | 6.3 | 2025-07-31 | A vulnerability classified as critical has been found in openviglet shio up to 0.3.8. Affected is the function shStaticFileUpload of the file shio-app/src/main… |
CVE-2025-50777 | High | 7.8 | 2025-07-30 | The firmware of the AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera (version V1.00.02) contains an Incorrect Access Control vulnerability that allows l… |
CVE-2025-53113 | Low | 2.7 | 2025-07-30 | GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, l… |
CVE-2025-53112 | Medium | 4.3 | 2025-07-30 | GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.1.0 t… |
CVE-2025-53111 | Medium | 6.5 | 2025-07-30 | GLPI is a Free Asset and IT Management Software package. In versions 0.80 through 10.0.18, a lack of permission checks can result in unauthorized access to som… |
CVE-2025-43270 | High | 8.8 | 2025-07-30 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An ap… |
CVE-2025-43241 | Medium | 5.5 | 2025-07-30 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app ma… |
CVE-2025-43233 | Critical | 9.8 | 2025-07-30 | This issue was addressed with improved access restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. A malicious a… |
CVE-2025-43232 | Critical | 9.8 | 2025-07-30 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app ma… |
CVE-2025-43198 | Critical | 9.8 | 2025-07-30 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. An app may be able to access protecte… |
CVE-2025-43194 | Critical | 9.8 | 2025-07-30 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to modif… |
CVE-2025-43192 | Critical | 9.8 | 2025-07-30 | A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. Account-driven User Enrollmen… |
CVE-2025-43184 | Critical | 9.8 | 2025-07-30 | This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.7, macOS Ventura 13.7.7… |
CVE-2024-42655 | High | 8.8 | 2025-07-29 | An access control issue in NanoMQ v0.21.10 allows attackers to bypass security restrictions and access sensitive system topic messages using MQTT wildcard char… |
CVE-2025-30133 | Critical | 9.8 | 2025-07-28 | An issue was discovered on IROAD Dashcam FX2 devices. Bypass of Device Pairing/Registration can occur. It requires device registration via the "IROAD X View" a… |
CVE-2025-27724 | Critical | 9.3 | 2025-07-28 | A privilege escalation vulnerability exists in the login.php functionality of meddream MedDream PACS Premium 7.3.3.840. A specially crafted .php file can lead… |
CVE-2025-8265 | Medium | 4.7 | 2025-07-28 | A vulnerability classified as critical has been found in 299Ko CMS 2.0.0. This affects an unknown part of the file /admin/filemanager/view of the component Fil… |
CVE-2025-8256 | Medium | 6.3 | 2025-07-28 | A vulnerability classified as critical has been found in code-projects Online Ordering System 1.0. Affected is an unknown function of the file /admin/product.p… |
CVE-2025-8255 | High | 7.3 | 2025-07-28 | A vulnerability was found in code-projects Exam Form Submission 1.0. It has been rated as critical. This issue affects some unknown processing of the file /reg… |
CVE-2025-8226 | Medium | 4.3 | 2025-07-27 | A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been classified as problematic. Affected is an unknown function of the file /sysApp/find… |
CVE-2025-8174 | Medium | 6.3 | 2025-07-26 | A vulnerability was found in code-projects Voting System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admi… |
CVE-2025-8171 | Medium | 6.3 | 2025-07-25 | A vulnerability, which was classified as critical, has been found in code-projects Document Management System 1.0. This issue affects some unknown processing o… |
CVE-2025-43712 | Low | 2.9 | 2025-07-25 | JHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter. Upon registering in the JHipster portal and logging in as a standard… |
CVE-2025-8128 | Medium | 6.3 | 2025-07-25 | A vulnerability, which was classified as critical, has been found in zhousg letao up to 7d8df0386a65228476290949e0413de48f7fbe98. This issue affects some unkno… |