CWE-284 · Improper Access Control (page 28)
Page 28 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-6741 | High | 7.7 | 2025-07-22 | Improper access control in secure message component in Devolutions Server allows an authenticated user to steal unauthorized entries via the secure message ent… |
CVE-2025-7939 | Medium | 6.3 | 2025-07-21 | A vulnerability was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 1.0. It has been classified as critical. Affected is the function addGoods of the file GoodsCo… |
CVE-2025-44654 | Critical | 9.8 | 2025-07-21 | In Linksys E2500 3.0.04.002, the chroot_local_user option is enabled in the vsftpd configuration file. This could lead to unauthorized access to system files… |
CVE-2025-7931 | High | 7.3 | 2025-07-21 | A vulnerability was found in code-projects Church Donation System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of t… |
CVE-2025-44657 | Low | 3.9 | 2025-07-21 | In Linksys EA6350 V2.1.2, the chroot_local_user option is enabled in the dynamically generated vsftpd configuration file. This could lead to unauthorized acces… |
CVE-2025-46118 | Medium | 5.3 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139 and in Ruckus ZoneDirector prior to 10.5.1.0.279, where hard-… |
CVE-2025-7906 | Medium | 6.3 | 2025-07-20 | A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1 and classified as critical. This issue affects the function uploadFile of the file ruoyi-admin/src… |
CVE-2025-7898 | Medium | 4.7 | 2025-07-20 | A vulnerability was found in Codecanyon iDentSoft 2.0. It has been classified as critical. This affects an unknown part of the file /clinica/profile/updateSett… |
CVE-2025-7895 | Medium | 6.3 | 2025-07-20 | A vulnerability, which was classified as critical, was found in harry0703 MoneyPrinterTurbo up to 1.2.6. Affected is the function upload_bgm_file of the file a… |
CVE-2025-7880 | Medium | 6.3 | 2025-07-20 | A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2 and classified as critical. Affected by this issue is some unknown functionality of the file /bu… |
CVE-2025-7879 | Medium | 6.3 | 2025-07-20 | A vulnerability has been found in Metasoft 美特软件 MetaCRM up to 6.4.2 and classified as critical. Affected by this vulnerability is an unknown functionality of t… |
CVE-2025-7878 | Medium | 6.3 | 2025-07-20 | A vulnerability, which was classified as critical, was found in Metasoft 美特软件 MetaCRM up to 6.4.2. Affected is an unknown function of the file /common/jsp/uplo… |
CVE-2025-7877 | Medium | 6.3 | 2025-07-20 | A vulnerability, which was classified as critical, has been found in Metasoft 美特软件 MetaCRM up to 6.4.2. This issue affects some unknown processing of the file… |
CVE-2025-7874 | Medium | 5.3 | 2025-07-20 | A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the f… |
CVE-2025-7864 | Medium | 6.3 | 2025-07-20 | A vulnerability was found in thinkgem JeeSite up to 5.12.0. It has been classified as critical. This affects the function Upload of the file src/main/java/com/… |
CVE-2025-52168 | Medium | 6.5 | 2025-07-18 | Incorrect access control in the dynawebservice component of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows unauthenticated attackers to access… |
CVE-2025-52166 | Medium | 6.5 | 2025-07-18 | Incorrect access control in Software GmbH Agorum core open v11.9.2 & v11.10.1 allows authenticated attackers to escalate privileges to Administrator and access… |
CVE-2025-45157 | Medium | 6.5 | 2025-07-18 | Insecure permissions in Splashin iOS v2.0 allow unauthorized attackers to access location data for specific users. |
CVE-2024-32124 | Medium | 4.3 | 2025-07-18 | An improper access control vulnerability [CWE-284] in FortiIsolator version 2.4.4, version 2.4.3, 2.3 all versions logging component may allow a remote authent… |
CVE-2025-7755 | Medium | 6.3 | 2025-07-17 | A vulnerability was found in code-projects Online Ordering System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /a… |
CVE-2025-53028 | High | 8.2 | 2025-07-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.1.10. Easily exploi… |
CVE-2025-50108 | Medium | 5.4 | 2025-07-15 | Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Workspace). The supported version that is affected is 11.2.20… |
CVE-2025-50107 | Medium | 6.1 | 2025-07-15 | Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Request handling). Supported versions that are affected are 12… |
CVE-2025-50105 | High | 8.1 | 2025-07-15 | Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Administration). Supported versions that are aff… |
CVE-2025-50087 | Medium | 4.9 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 a… |
CVE-2025-50081 | Low | 3.1 | 2025-07-15 | Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 a… |
CVE-2025-50072 | Medium | 4.0 | 2025-07-15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1… |
CVE-2025-50071 | Medium | 6.4 | 2025-07-15 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities). Supported versions that are affected are 12… |
CVE-2025-50070 | Medium | 5.3 | 2025-07-15 | Vulnerability in the JDBC component of Oracle Database Server. Supported versions that are affected are 23.4-23.8. Difficult to exploit vulnerability allows l… |
CVE-2025-50060 | High | 8.1 | 2025-07-15 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 7.6.0.0.0, 8.2.0.0.0 an… |
CVE-2025-50059 | High | 8.6 | 2025-07-15 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported ve… |
CVE-2025-30760 | Medium | 5.4 | 2025-07-15 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0… |
CVE-2025-30759 | Medium | 6.1 | 2025-07-15 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). Supported versions that are a… |
CVE-2025-30754 | Medium | 4.8 | 2025-07-15 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions… |
CVE-2025-7627 | Medium | 6.3 | 2025-07-14 | A vulnerability was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical. Affected by this issue… |
CVE-2025-7576 | High | 7.3 | 2025-07-14 | A vulnerability was found in Teledyne FLIR FB-Series O and FLIR FH-Series ID 1.3.2.16 and classified as critical. Affected by this issue is some unknown functi… |
CVE-2025-7573 | Medium | 5.3 | 2025-07-14 | A vulnerability, which was classified as critical, has been found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 202… |
CVE-2025-7572 | Medium | 5.3 | 2025-07-14 | A vulnerability classified as critical was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. This vulne… |
CVE-2025-7565 | Medium | 5.3 | 2025-07-14 | A vulnerability, which was classified as critical, was found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function geteasycfg of the file /cgi-bin/light… |
CVE-2025-7552 | Medium | 6.3 | 2025-07-14 | A vulnerability was found in Dromara Northstar up to 7.3.5. It has been rated as critical. Affected by this issue is the function preHandle of the file northst… |
CVE-2025-7547 | High | 7.3 | 2025-07-13 | A vulnerability, which was classified as critical, was found in Campcodes Online Movie Theater Seat Reservation System 1.0. This affects the function save_movi… |
CVE-2025-7538 | High | 7.3 | 2025-07-13 | A vulnerability classified as critical was found in Campcodes Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/produc… |
CVE-2025-7487 | Medium | 6.3 | 2025-07-12 | A vulnerability, which was classified as critical, was found in JoeyBling SpringBoot_MyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26. This affects t… |
CVE-2025-7477 | Medium | 4.7 | 2025-07-12 | A vulnerability, which was classified as critical, has been found in code-projects Simple Car Rental System 1.0. This issue affects some unknown processing of… |
CVE-2025-7470 | High | 7.3 | 2025-07-12 | A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been classified as critical. Affected is an unknown function of the file /pages/p… |
CVE-2025-52963 | Medium | 5.5 | 2025-07-11 | An Improper Access Control vulnerability in the User Interface (UI) of Juniper Networks Junos OS allows a local, low-privileged attacker to bring down an inter… |
CVE-2025-7413 | Medium | 6.3 | 2025-07-10 | A vulnerability classified as critical has been found in code-projects Library System 1.0. This affects an unknown part of the file /user/teacher/profile.php… |
CVE-2025-7412 | Medium | 6.3 | 2025-07-10 | A vulnerability was found in code-projects Library System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2025-23048 | Critical | 9.1 | 2025-07-10 | In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session re… |
CVE-2025-44525 | Medium | 6.5 | 2025-07-09 | Texas Instruments CC2652RB LaunchPad SimpleLink CC13XX CC26XX SDK 7.41.00.17 was discovered to utilize insufficient permission checks on critical fields within… |
CVE-2025-44526 | Medium | 6.5 | 2025-07-09 | Realtek RTL8762EKF-EVB RTL8762E SDK V1.4.0 was discovered to utilize insufficient permission checks on critical fields within Bluetooth Low Energy (BLE) data p… |
CVE-2025-7210 | Medium | 6.3 | 2025-07-09 | A vulnerability was found in code-projects/Fabian Ros Library Management System 2.0 and classified as critical. Affected by this issue is some unknown function… |
CVE-2025-49546 | Low | 2.4 | 2025-07-08 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Access Control vulnerability that could lead to a partial application deni… |
CVE-2025-7190 | Medium | 6.3 | 2025-07-08 | A vulnerability, which was classified as critical, was found in code-projects Library Management System 2.0. This affects an unknown part of the file /admin/st… |
CVE-2025-48817 | High | 8.8 | 2025-07-08 | Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
CVE-2025-47993 | High | 7.8 | 2025-07-08 | Improper access control in Microsoft PC Manager allows an authorized attacker to elevate privileges locally. |
CVE-2025-7181 | Medium | 6.3 | 2025-07-08 | A vulnerability, which was classified as critical, was found in code-projects Staff Audit System 1.0. Affected is an unknown function of the file /test.php. Th… |
CVE-2025-7175 | Medium | 6.3 | 2025-07-08 | A vulnerability was found in code-projects E-Commerce Site 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/users_ph… |
CVE-2025-23365 | High | 7.8 | 2025-07-08 | A vulnerability has been identified in TIA Administrator (All versions < V3.0.6). The affected application allows low-privileged users to trigger installations… |
CVE-2025-7152 | Medium | 6.3 | 2025-07-08 | A vulnerability classified as critical has been found in Campcodes Advanced Online Voting System 1.0. Affected is an unknown function of the file /admin/candid… |
CVE-2025-7151 | Medium | 6.3 | 2025-07-07 | A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2025-20324 | Medium | 5.4 | 2025-07-07 | In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.7, and 9.1.10 and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, a lo… |
CVE-2025-20323 | Medium | 4.3 | 2025-07-07 | In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could turn of… |
CVE-2025-7124 | Medium | 6.3 | 2025-07-07 | A vulnerability classified as critical has been found in code-projects Online Note Sharing 1.0. Affected is an unknown function of the file /dashboard/userprof… |
CVE-2025-7100 | Medium | 6.3 | 2025-07-07 | A vulnerability was found in BoyunCMS up to 1.4.20 and classified as critical. Affected by this issue is some unknown functionality of the file /application/us… |
CVE-2025-7076 | Medium | 5.4 | 2025-07-06 | A vulnerability was found in BlackVue Dashcam 590X up to 20250624. It has been rated as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2025-7075 | Medium | 6.3 | 2025-07-06 | A vulnerability was found in BlackVue Dashcam 590X up to 20250624. It has been declared as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2025-6786 | Medium | 5.3 | 2025-07-04 | The DocCheck Login plugin for WordPress is vulnerable to unauthorized post access in all versions up to, and including, 1.1.5. This is due to plugin redirectin… |
CVE-2025-53501 | High | 8.8 | 2025-07-03 | Improper Access Control vulnerability in Wikimedia Foundation Mediawiki - Scribunto Extension allows : Accessing Functionality Not Properly Constrained by Auth… |
CVE-2025-45424 | Medium | 5.3 | 2025-07-02 | Incorrect access control in Xinference before v1.4.0 allows attackers to access the Web GUI without authentication. |
CVE-2025-52101 | Critical | 9.8 | 2025-07-01 | linjiashop <=0.9 is vulnerable to Incorrect Access Control. When using the default-generated JWT authentication, attackers can bypass the authentication and re… |
CVE-2025-27153 | Medium | 6.5 | 2025-07-01 | Escalade GLPI plugin is a ticket escalation process helper for GLPI. Prior to version 2.9.11, there is an improper access control vulnerability. This can lead… |
CVE-2025-45083 | Medium | 6.1 | 2025-07-01 | Incorrect access control in Ullu (Android version v2.9.929 and IOS version v2.8.0) allows attackers to bypass parental pin feature via unspecified vectors. |
CVE-2025-45081 | High | 8.8 | 2025-07-01 | Misconfigured settings in IITB SSO v1.1.0 allow attackers to access sensitive application data. |
CVE-2025-50405 | Medium | 6.5 | 2025-07-01 | Intelbras RX1500 Router v2.2.17 and before is vulnerable to Incorrect Access Control in the FirmwareUpload function and GetFirmwareValidation function. |
CVE-2025-53003 | | 2025-07-01 | The Janssen Project is an open-source identity and access management (IAM) platform. Prior to version 1.8.0, the Config API returns results without scope verif… | |
CVE-2025-6900 | Medium | 6.3 | 2025-06-30 | A vulnerability has been found in code-projects Library System 1.0 and classified as critical. This vulnerability affects unknown code of the file /add-book.ph… |
CVE-2025-46014 | High | 8.8 | 2025-06-30 | Several services in Honor Device Co., Ltd Honor PC Manager v16.0.0.118 was discovered to connect services to the named pipe iMateBookAssistant with default or… |
CVE-2025-6873 | Medium | 4.7 | 2025-06-29 | A vulnerability, which was classified as critical, has been found in SourceCodester Simple Company Website 1.0. This issue affects some unknown processing of t… |
CVE-2025-6872 | Medium | 4.7 | 2025-06-29 | A vulnerability classified as critical was found in SourceCodester Simple Company Website 1.0. This vulnerability affects unknown code of the file /classes/Sys… |
CVE-2025-6870 | Medium | 4.7 | 2025-06-29 | A vulnerability was found in SourceCodester Simple Company Website 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-6848 | Medium | 6.3 | 2025-06-29 | A vulnerability, which was classified as critical, has been found in code-projects Simple Forum 1.0. This issue affects some unknown processing of the file /fo… |
CVE-2025-6843 | High | 7.3 | 2025-06-29 | A vulnerability was found in code-projects Simple Photo Gallery 1.0. It has been classified as critical. Affected is an unknown function of the file /upload-ph… |
CVE-2025-6837 | Medium | 6.3 | 2025-06-29 | A vulnerability classified as critical was found in code-projects Library System 1.0. Affected by this vulnerability is an unknown functionality of the file /p… |
CVE-2023-29113 | Medium | 6.3 | 2025-06-28 | The MIB3 infotainment unit used in Skoda and Volkswagen vehicles does not incorporate any privilege separation for the proprietary inter-process communication… |
CVE-2023-28907 | Medium | 6.7 | 2025-06-28 | There is no memory isolation between CPU cores of the MIB3 infotainment. This fact allows an attacker with access to the main operating system to compromise th… |
CVE-2025-45729 | Medium | 6.3 | 2025-06-27 | D-Link DIR-823-Pro 1.02 has improper permission control, allowing unauthorized users to turn on and access Telnet services. |
CVE-2025-49603 | Critical | 9.1 | 2025-06-26 | Northern.tech Mender Server before 3.7.11 and 4.x before 4.0.1 has Incorrect Access Control. |
CVE-2024-52928 | Critical | 9.6 | 2025-06-26 | Arc before 1.26.1 on Windows has a bypass issue in the site settings that allows websites (with previously granted permissions) to add new permissions when the… |
CVE-2025-6667 | Medium | 6.3 | 2025-06-25 | A vulnerability was found in code-projects Car Rental System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /… |
CVE-2025-6443 | High | 7.2 | 2025-06-25 | Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability. This vulnerability allows remote attackers to bypass access restrictions on affected i… |
CVE-2025-6532 | Medium | 4.3 | 2025-06-24 | A vulnerability classified as problematic was found in NOYAFA/Xiami LF9 Pro up to 20250611. Affected by this vulnerability is an unknown functionality of the c… |
CVE-2025-6531 | Medium | 4.3 | 2025-06-24 | A vulnerability was found in SIFUSM/MZZYG BD S1 up to 20250611. It has been declared as problematic. This vulnerability affects unknown code of the component R… |
CVE-2025-6527 | Low | 3.1 | 2025-06-23 | A vulnerability, which was classified as problematic, was found in 70mai M300 up to 20250611. Affected is an unknown function of the component Web Server. The… |
CVE-2023-47031 | Critical | 9.8 | 2025-06-23 | An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to escalate privileges via a crafted POST request to the grantRolesToUsers, grantRolesToGroup… |
CVE-2023-47294 | High | 8.1 | 2025-06-23 | An issue in NCR Terminal Handler v1.5.1 allows low-level privileged authenticated attackers to arbitrarily deactivate, lock, and delete user accounts via a cra… |
CVE-2023-47297 | Critical | 9.8 | 2025-06-23 | A settings manipulation vulnerability in NCR Terminal Handler v1.5.1 allows attackers to execute arbitrary commands, including editing system security auditing… |
CVE-2025-6466 | Medium | 6.3 | 2025-06-22 | A vulnerability was found in ageerle ruoyi-ai 2.0.0 and classified as critical. Affected by this issue is the function speechToTextTranscriptionsV2/upload of t… |
CVE-2025-6422 | Medium | 6.3 | 2025-06-21 | A vulnerability classified as critical was found in Campcodes Online Recruitment Management System 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2025-6266 | Medium | 6.3 | 2025-06-19 | A vulnerability was detected in Teledyne FLIR AX8 up to 1.46. Affected by this vulnerability is an unknown functionality of the file /upload.php. Performing ma… |