CWE-284 · Improper Access Control (page 40)
Page 40 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-65796 | Medium | 4.3 | 2025-12-08 | Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily delete reactions made to other users' Memos. |
CVE-2025-14219 | Medium | 4.7 | 2025-12-08 | A weakness has been identified in Campcodes Retro Basketball Shoes Online Store 1.0. The impacted element is an unknown function of the file /admin/admin_runni… |
CVE-2025-14199 | Medium | 6.3 | 2025-12-07 | A flaw has been found in Verysync 微力同步 up to 2.21.3. This impacts an unknown function of the file /rest/f/api/resources/f96956469e7be39d/tmp/text.txt?override=… |
CVE-2025-14198 | Medium | 5.3 | 2025-12-07 | A vulnerability was detected in Verysync 微力同步 2.21.3. This affects an unknown function of the file /safebrowsing/clientreport/download?key=dummytoken of the co… |
CVE-2025-14197 | Medium | 5.3 | 2025-12-07 | A security vulnerability has been detected in Verysync 微力同步 up to 2.21.3. The impacted element is an unknown function of the file /rest/f/api/resources/f969564… |
CVE-2025-14195 | Medium | 6.3 | 2025-12-07 | A security flaw has been discovered in code-projects Employee Profile Management System 1.0. Impacted is an unknown function of the file /profiling/add_file_qu… |
CVE-2025-66557 | Medium | 5.4 | 2025-12-05 | Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.14.6 and… |
CVE-2025-14086 | Medium | 6.3 | 2025-12-05 | A vulnerability was found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is an unknown function of the file /app-api/v1/members/openid/. The manipulation of t… |
CVE-2025-14052 | Medium | 6.3 | 2025-12-05 | A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected by this vulnerability is the function getMemberById of the file /mall-ums/app-ap… |
CVE-2025-66509 | Critical | 9.8 | 2025-12-04 | LaraDashboard is an all-In-one solution to start a Laravel Application. In 2.3.0 and earlier, the password reset flow trusts the Host header, allowing attacker… |
CVE-2025-63363 | High | 7.5 | 2025-12-04 | A lack of Management Frame Protection in Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07… |
CVE-2025-63681 | Medium | 4.3 | 2025-12-04 | open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, en… |
CVE-2025-57213 | High | 7.5 | 2025-12-04 | Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensitive information via a crafted request. |
CVE-2025-57212 | High | 7.5 | 2025-12-04 | Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive information via a crafted request. |
CVE-2025-57210 | High | 7.5 | 2025-12-04 | Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive information via unspecified vectors. |
CVE-2025-65097 | Medium | 6.5 | 2025-12-03 | RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2… |
CVE-2025-65096 | Medium | 4.3 | 2025-12-03 | RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2… |
CVE-2025-65841 | Medium | 6.2 | 2025-12-03 | Aquarius Desktop 3.0.069 for macOS stores user authentication credentials in the local file ~/Library/Application Support/Aquarius/aquarius.settings using a we… |
CVE-2025-13949 | Medium | 6.3 | 2025-12-03 | A vulnerability was identified in ProudMuBai GoFilm 1.0.0/1.0.1. Impacted is the function SingleUpload of the file /server/controller/FileController.go. The ma… |
CVE-2025-59703 | Critical | 9.1 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a Physically Proximate Att… |
CVE-2025-59702 | High | 7.2 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate att… |
CVE-2025-59697 | High | 7.2 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate att… |
CVE-2025-55749 | High | 7.5 | 2025-12-01 | XWiki is an open-source wiki software platform. From 16.7.0 to 16.10.11, 17.4.4, or 17.7.0, in an instance which is using the XWiki Jetty package (XJetty), a c… |
CVE-2025-61229 | High | 7.8 | 2025-12-01 | An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary preflight script wit… |
CVE-2025-57489 | High | 8.1 | 2025-12-01 | Incorrect access control in the SDAgent component of Shirt Pocket SuperDuper! v3.10 allows attackers to escalate privileges to root due to the improper use of… |
CVE-2025-63525 | Critical | 9.6 | 2025-12-01 | An issue was discovered in Blood Bank Management System 1.0 allowing authenticated attackers to perform actions with escalated privileges via crafted request t… |
CVE-2025-13815 | Medium | 6.3 | 2025-12-01 | A weakness has been identified in moxi159753 Mogu Blog v2 up to 5.2. The affected element is an unknown function of the file /file/pictures. This manipulation… |
CVE-2025-13804 | Medium | 4.3 | 2025-12-01 | A security flaw has been discovered in nutzam NutzBoot up to 2.6.0-SNAPSHOT. The impacted element is an unknown function of the file nutzboot-demo/nutzboot-dem… |
CVE-2025-13785 | Medium | 4.3 | 2025-11-30 | A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.5. This issue affects some unknown processing of the file /user… |
CVE-2025-66223 | | 2025-11-29 | OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not expire once issued, remain valid even afte… | |
CVE-2025-66027 | Medium | 6.5 | 2025-11-29 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, includ… |
CVE-2025-64715 | Medium | 4.0 | 2025-11-29 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.16.17, 1.17.10, and 1.18.4, CiliumNetworkPolicys… |
CVE-2025-65276 | Critical | 9.8 | 2025-11-26 | An unauthenticated administrative access vulnerability exists in the open-source HashTech project (https://github.com/henzljw/hashtech) 1.0 thru commit 5919dec… |
CVE-2025-66028 | High | 8.2 | 2025-11-26 | OneUptime is a solution for monitoring and managing online services. Prior to version 8.0.5567, OneUptime is vulnerable to privilege escalation via Login Respo… |
CVE-2025-55471 | High | 7.5 | 2025-11-26 | Incorrect access control in the getUserFormData function of youlai-boot v2.21.1 allows attackers to access sensitive information for other users. |
CVE-2025-55469 | Critical | 9.8 | 2025-11-26 | Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend. |
CVE-2025-65239 | Medium | 4.3 | 2025-11-26 | Incorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gateway OC Release:5, version 6.13.11 allows attackers with low-level priv… |
CVE-2025-65238 | Medium | 6.5 | 2025-11-26 | Incorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 allows attackers with low-level p… |
CVE-2025-46175 | High | 7.5 | 2025-11-26 | Ruoyi v4.8.0 is vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the authRole method of SysUserController.java. |
CVE-2025-56396 | High | 8.8 | 2025-11-26 | An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the owning department having higher rights than the active user. |
CVE-2025-46174 | High | 7.5 | 2025-11-26 | Ruoyi v4.8.0 vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the resetPwd Method of SysUserController.java. |
CVE-2025-65963 | Medium | 5.4 | 2025-11-26 | Files is a module for managing files inside spaces and user profiles. Prior to versions 0.16.11 and 0.17.2, insufficient authorization checks allow non-member… |
CVE-2025-64064 | High | 8.8 | 2025-11-25 | Primakon Pi Portal 1.0.18 /api/v2/pp_users endpoint fails to adequately check user permissions before processing a PATCH request to modify the PP_SECURITY_PROF… |
CVE-2025-64066 | High | 8.6 | 2025-11-25 | Primakon Pi Portal 1.0.18 REST /api/v2/user/register endpoint suffers from a Broken Access Control vulnerability. The endpoint fails to implement any authoriza… |
CVE-2025-54563 | High | 7.5 | 2025-11-24 | An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Incorrect Acc… |
CVE-2025-54338 | High | 7.5 | 2025-11-24 | An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker t… |
CVE-2025-63958 | Critical | 9.8 | 2025-11-24 | MILLENSYS Vision Tools Workspace 6.5.0.2585 exposes a sensitive configuration endpoint (/MILLENSYS/settings) that is accessible without authentication. This pa… |
CVE-2025-13574 | Medium | 4.7 | 2025-11-24 | A weakness has been identified in code-projects Online Bidding System 1.0. This issue affects the function categoryadd of the file /administrator/addcategory.p… |
CVE-2025-13573 | Medium | 6.3 | 2025-11-24 | A security flaw has been discovered in projectworlds can pass malicious payloads up to 1.0. This vulnerability affects unknown code of the file /add_book.php… |
CVE-2025-13544 | Medium | 6.3 | 2025-11-23 | A weakness has been identified in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected is an unknown function of the file /custo… |
CVE-2025-31216 | Low | 2.4 | 2025-11-21 | The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. An attacker with physical access to a device may… |
CVE-2025-64483 | | 2025-11-21 | Wazuh is a security detection, visibility, and compliance open source project. From version 4.9.0 to before 4.13.0, the Wazuh API – Agent Configuration in cert… | |
CVE-2025-64660 | High | 8.0 | 2025-11-20 | Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network. |
CVE-2025-48986 | High | 8.8 | 2025-11-20 | Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy t… |
CVE-2025-60799 | Medium | 6.1 | 2025-11-20 | phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in sql.php at lines 68-76. The application allows unauthorized manipulation of… |
CVE-2025-13443 | Medium | 5.4 | 2025-11-20 | A vulnerability was detected in macrozheng mall up to 1.0.3. Affected by this issue is the function delete of the file /member/readHistory/delete. Performing m… |
CVE-2025-13423 | Medium | 4.7 | 2025-11-20 | A flaw has been found in Campcodes Retro Basketball Shoes Online Store 1.0. The impacted element is an unknown function of the file /admin/admin_product.php. E… |
CVE-2025-13411 | Medium | 4.7 | 2025-11-19 | A vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/a… |
CVE-2025-63214 | Medium | 6.5 | 2025-11-19 | An issue was discovered in bridgetech VBC Server & Element Manager, firmware version 6.5.0-10 , 6.5.0-9, allowing unauthorized attackers to delete and create a… |
CVE-2025-63223 | Critical | 9.8 | 2025-11-19 | The Axel Technology StreamerMAX MK II devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the /… |
CVE-2025-63221 | Critical | 9.1 | 2025-11-19 | The Axel Technology puma devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFc… |
CVE-2025-63219 | High | 7.5 | 2025-11-19 | The ITEL ISO FM SFN Adapter (firmware ISO2 2.0.0.0, WebServer 2.0) is vulnerable to session hijacking due to improper session management on the /home.html endp… |
CVE-2025-63218 | Critical | 9.8 | 2025-11-19 | The Axel Technology WOLF1MS and WOLF2MS devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the… |
CVE-2025-63225 | Critical | 9.8 | 2025-11-18 | The Eurolab ELTS100_UBX device (firmware version ELTS100v1.UBX) is vulnerable to Broken Access Control due to missing authentication on critical administrative… |
CVE-2025-56499 | Medium | 6.5 | 2025-11-18 | Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated privileges via obtai… |
CVE-2025-37155 | High | 7.8 | 2025-11-18 | A vulnerability in the SSH restricted shell interface of the network management services allows improper access control for authenticated read-only users. If s… |
CVE-2025-53360 | Medium | 4.3 | 2025-11-18 | pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. In… |
CVE-2025-41737 | High | 7.5 | 2025-11-18 | Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules. |
CVE-2025-13275 | Medium | 4.7 | 2025-11-17 | A security vulnerability has been detected in Iqbolshoh php-business-website up to 10677743a8dfc281f85291a27cf63a0bce043c24. This affects an unknown part of th… |
CVE-2025-13250 | Medium | 6.3 | 2025-11-16 | A vulnerability was detected in WeiYe-Jing datax-web up to 2.1.2. This impacts the function remove/update/pause/start/triggerJob of the component Job Handler… |
CVE-2025-13249 | Medium | 6.3 | 2025-11-16 | A security vulnerability has been detected in Jiusi OA up to 20251102. This affects an unknown function of the file /OfficeServer?isAjaxDownloadTemplate=false… |
CVE-2025-13238 | Medium | 6.3 | 2025-11-16 | A weakness has been identified in Bdtask Flight Booking Software 4. Affected by this vulnerability is an unknown functionality of the file /agent/profile/edit… |
CVE-2025-13198 | Medium | 4.7 | 2025-11-15 | A vulnerability has been found in DouPHP up to 1.8 Release 20251022. This impacts an unknown function of the file upload/include/file.class.php. The manipulati… |
CVE-2025-12182 | Medium | 4.3 | 2025-11-15 | The Qi Blocks plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the `resize_image_callback()` function in all vers… |
CVE-2025-13185 | Medium | 4.7 | 2025-11-14 | A security flaw has been discovered in Bdtask/CodeCanyon News365 up to 7.0.3. This affects an unknown function of the file /admin/dashboard/profile. The manipu… |
CVE-2025-54561 | Medium | 4.3 | 2025-11-14 | An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows remote access… |
CVE-2025-54343 | Critical | 9.6 | 2025-11-14 | An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 exploitable remotely for E… |
CVE-2025-54339 | Critical | 10.0 | 2025-11-14 | An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 exploitable remotely for E… |
CVE-2025-64746 | Medium | 4.6 | 2025-11-13 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.13.0, Directus does not properly clean up field-level perm… |
CVE-2025-47222 | Medium | 6.5 | 2025-11-13 | A class name enumeration was found in Keyfactor SignServer versions prior to 7.3.2. Setting any chosen class name to any of the properties requiring a class pa… |
CVE-2025-47221 | Medium | 5.3 | 2025-11-13 | An arbitrary file write was found in Keyfactor SignServer versions prior to 7.3.2. The properties ARCHIVETODISK_FILENAME-PATTERN, ARCHIVETODISK_PATH_BASE, ARCH… |
CVE-2025-47220 | Medium | 5.3 | 2025-11-13 | A local file enumeration was found in Keyfactor SignServer versions prior to 7.3.2 .The property VISIBLE_SIGNATURE_CUSTOM_IMAGE_PATH, which exists in the PDFSi… |
CVE-2025-46362 | Medium | 6.6 | 2025-11-13 | Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain an Improper Access Control vulnerability. A low privileged attacker with local a… |
CVE-2025-43515 | High | 8.8 | 2025-11-13 | The issue was addressed by refusing external connections by default. This issue is fixed in Compressor 4.11.1. An unauthenticated user on the same network as a… |
CVE-2025-64706 | Medium | 5.0 | 2025-11-13 | Typebot is an open-source chatbot builder. In version 3.9.0 up to but excluding version 3.13.0, an Insecure Direct Object Reference (IDOR) vulnerability exists… |
CVE-2025-20341 | High | 8.8 | 2025-11-13 | A vulnerability in Cisco Catalyst Center Virtual Appliance could allow an authenticated, remote attacker to elevate privileges to Administrator on an affected… |
CVE-2025-46608 | Critical | 9.1 | 2025-11-12 | Dell Data Lakehouse, versions prior to 1.6.0.0, contain(s) an Improper Access Control vulnerability. A high privileged attacker with remote access could potent… |
CVE-2025-13061 | Medium | 6.3 | 2025-11-12 | A vulnerability was detected in itsourcecode Online Voting System 1.0. This impacts an unknown function of the file /index.php?page=manage_voting. Performing m… |
CVE-2025-63353 | Critical | 9.8 | 2025-11-12 | A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be predicted from the SSI… |
CVE-2025-63667 | High | 7.5 | 2025-11-12 | Incorrect access control in SIMICAM v1.16.41-20250725, KEVIEW v1.14.92-20241120, ASECAM v1.14.10-20240725 allows attackers to access sensitive API endpoints wi… |
CVE-2025-63666 | Critical | 9.8 | 2025-11-12 | Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the… |
CVE-2025-60705 | High | 7.8 | 2025-11-11 | Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-59512 | High | 7.8 | 2025-11-11 | Improper access control in Customer Experience Improvement Program (CEIP) allows an authorized attacker to elevate privileges locally. |
CVE-2025-47179 | Medium | 6.7 | 2025-11-11 | Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges locally. |
CVE-2025-32037 | Low | 2.0 | 2025-11-11 | Improper access control for some Intel(R) PresentMon before version 2.3.1 within Ring 3: User Applications may allow a denial of service. Network adversary wit… |
CVE-2025-24516 | Medium | 4.5 | 2025-11-11 | Improper access control for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an information disclosure… |
CVE-2025-24314 | Low | 2.2 | 2025-11-11 | Improper access control for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an information disclosure… |
CVE-2025-22391 | Medium | 6.7 | 2025-11-11 | Improper access control for some SigTest before version 6.1.10 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adv… |
CVE-2025-60876 | Medium | 6.5 | 2025-11-10 | BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be sp… |
CVE-2025-12480 | Critical | 9.1 | 2025-11-10 | Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is com… |