CWE-284 · Improper Access Control (page 42)
Page 42 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48025 | Medium | 4.3 | 2025-10-20 | In Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000, there is an improper access control vu… |
CVE-2025-56219 | High | 7.1 | 2025-10-20 | Incorrect access control in SigningHub v8.6.8 allows attackers to arbitrarily add user accounts without any rate limiting. This can lead to a resource exhausti… |
CVE-2025-11908 | Medium | 6.3 | 2025-10-17 | A security flaw has been discovered in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The affected element is the function uploadFile of the file /FileDir… |
CVE-2025-57567 | Critical | 9.1 | 2025-10-17 | A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme director… |
CVE-2025-11853 | Medium | 6.3 | 2025-10-16 | A vulnerability was determined in Sismics Teedy up to 1.11. This affects an unknown function of the file /api/file of the component API Endpoint. Executing a m… |
CVE-2025-53092 | Medium | 6.5 | 2025-10-16 | Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installat… |
CVE-2025-61543 | High | 7.1 | 2025-10-16 | A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4.0.2.2. The system uses `$_SERVER['HTTP_HOST']` directly to con… |
CVE-2025-61541 | High | 7.1 | 2025-10-16 | Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using… |
CVE-2025-9804 | Critical | 9.6 | 2025-10-16 | An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services an… |
CVE-2025-43313 | Medium | 5.5 | 2025-10-15 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be abl… |
CVE-2025-59494 | High | 7.8 | 2025-10-14 | Improper access control in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. |
CVE-2025-59253 | Medium | 5.5 | 2025-10-14 | Improper access control in Microsoft Windows Search Component allows an authorized attacker to deny service locally. |
CVE-2025-59230 | High | 7.8 | 2025-10-14 | Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. |
CVE-2025-59201 | High | 7.8 | 2025-10-14 | Improper access control in Network Connection Status Indicator (NCSI) allows an authorized attacker to elevate privileges locally. |
CVE-2025-59199 | High | 7.8 | 2025-10-14 | Improper access control in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally. |
CVE-2025-58726 | High | 7.5 | 2025-10-14 | Improper access control in Windows SMB Server allows an authorized attacker to elevate privileges over a network. |
CVE-2025-58724 | High | 7.8 | 2025-10-14 | Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally. |
CVE-2025-58714 | High | 7.8 | 2025-10-14 | Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-55694 | High | 7.8 | 2025-10-14 | Improper access control in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
CVE-2025-55240 | High | 7.3 | 2025-10-14 | Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally. |
CVE-2025-54603 | Critical | 9.0 | 2025-10-14 | An incorrect OIDC authentication flow in Claroty Secure Access 3.3.0 through 4.0.2 can result in unauthorized user creation or impersonation of existing OIDC u… |
CVE-2025-47989 | High | 7.0 | 2025-10-14 | Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally. |
CVE-2025-37143 | Medium | 4.9 | 2025-10-14 | An arbitrary file download vulnerability exists in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. S… |
CVE-2025-37142 | Medium | 4.9 | 2025-10-14 | Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation… |
CVE-2025-37141 | Medium | 4.9 | 2025-10-14 | Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation… |
CVE-2025-37140 | Medium | 4.9 | 2025-10-14 | Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation… |
CVE-2025-37137 | Medium | 6.5 | 2025-10-14 | Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation o… |
CVE-2025-37136 | Medium | 6.5 | 2025-10-14 | Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation o… |
CVE-2025-37135 | Medium | 6.5 | 2025-10-14 | Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation o… |
CVE-2025-25004 | High | 7.3 | 2025-10-14 | Improper access control in Microsoft PowerShell allows an authorized attacker to elevate privileges locally. |
CVE-2025-0033 | Medium | 6.0 | 2025-10-14 | Improper access control within AMD SEV-SNP could allow an admin privileged attacker to write to the RMP during SNP initialization, potentially resulting in a l… |
CVE-2025-11716 | Medium | 6.5 | 2025-10-14 | Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission. This vulnerability was fixed in Firefox 144 and Thu… |
CVE-2025-27258 | Critical | 9.8 | 2025-10-13 | Ericsson Network Manager (ENM) versions prior to ENM 25.1 GA contain a vulnerability, if exploited, can result in an escalation of privilege. |
CVE-2025-11660 | High | 7.3 | 2025-10-13 | A vulnerability has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this issue is some u… |
CVE-2025-11659 | High | 7.3 | 2025-10-13 | A flaw has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this vulnerability is an unkn… |
CVE-2025-11658 | High | 7.3 | 2025-10-13 | A vulnerability was detected in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected is an unknown function of… |
CVE-2025-11657 | High | 7.3 | 2025-10-13 | A security vulnerability has been detected in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This impacts an unkn… |
CVE-2025-11656 | High | 7.3 | 2025-10-13 | A weakness has been identified in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This affects an unknown function… |
CVE-2025-11655 | Medium | 4.7 | 2025-10-13 | A security flaw has been discovered in Total.js Flow up to 673ef9144dd25d4f4fd4fdfda5af27f230198924. The impacted element is an unknown function of the compone… |
CVE-2025-11647 | Low | 3.1 | 2025-10-12 | A flaw has been found in Tomofun Furbo 360 and Furbo Mini. This issue affects some unknown processing of the component GATT Service. This manipulation of the a… |
CVE-2025-11646 | Medium | 6.3 | 2025-10-12 | A vulnerability was detected in Tomofun Furbo 360 and Furbo Mini. This vulnerability affects unknown code of the component GATT Service. The manipulation resul… |
CVE-2025-11641 | Low | 3.9 | 2025-10-12 | A vulnerability was determined in Tomofun Furbo 360 and Furbo Mini. This impacts an unknown function of the component Trial Restriction Handler. This manipulat… |
CVE-2025-11634 | Low | 2.4 | 2025-10-12 | A security flaw has been discovered in Tomofun Furbo 360 and Furbo Mini. This affects an unknown part of the component UART Interface. The manipulation results… |
CVE-2025-62159 | | 2025-10-10 | External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. A vulnerability was discover… | |
CVE-2025-60306 | Critical | 9.9 | 2025-10-10 | code-projects Simple Car Rental System 1.0 has a permission bypass issue where low privilege users can forge high privilege sessions and perform sensitive oper… |
CVE-2025-60305 | High | 8.8 | 2025-10-10 | SourceCodester Online Student Clearance System 1.0 is vulnerable to Incorrect Access Control. The application contains a logic flaw which allows low privilege… |
CVE-2025-59218 | Critical | 9.6 | 2025-10-09 | Azure Entra ID Elevation of Privilege Vulnerability |
CVE-2025-45095 | High | 7.3 | 2025-10-09 | Lavasoft Web Companion (also known as Ad-Aware WebCompanion) versions 8.9.0.1091 through 12.1.3.1037 installs the DCIService.exe service with an unquoted servi… |
CVE-2025-11508 | Medium | 4.7 | 2025-10-08 | A security vulnerability has been detected in code-projects Voting System 1.0. This affects an unknown function of the file /admin/voters_add.php. Such manipul… |
CVE-2025-36636 | Medium | 4.3 | 2025-10-08 | In Tenable Security Center versions prior to 6.7.0, an improper access control vulnerability exists where an authenticated user could access areas outside of t… |
CVE-2025-11470 | Medium | 4.7 | 2025-10-08 | A security vulnerability has been detected in SourceCodester Hotel and Lodge Management System up to 1.0. The impacted element is an unknown function of the fi… |
CVE-2025-11440 | Medium | 4.3 | 2025-10-08 | A vulnerability was determined in JhumanJ OpnForm up to 1.9.3. Impacted is an unknown function of the file /edit. Executing manipulation can lead to improper a… |
CVE-2025-11436 | Medium | 6.3 | 2025-10-08 | A vulnerability was detected in JhumanJ OpnForm up to 1.9.3. Affected by this issue is some unknown functionality of the file /answer. The manipulation results… |
CVE-2025-11426 | Medium | 6.3 | 2025-10-08 | A security flaw has been discovered in projectworlds Advanced Library Management System 1.0. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-11417 | Medium | 6.3 | 2025-10-08 | A weakness has been identified in Campcodes Advanced Online Voting Management System 1.0. This vulnerability affects unknown code of the file /admin/voters_add… |
CVE-2025-11406 | Medium | 4.3 | 2025-10-07 | A security flaw has been discovered in kaifangqian kaifangqian-base up to 7b3faecda13848b3ced6c17c7423b76c5b47b8ab. This issue affects the function getAllUsers… |
CVE-2025-11398 | Medium | 6.3 | 2025-10-07 | A weakness has been identified in SourceCodester Hotel and Lodge Management System 1.0. The impacted element is an unknown function of the file /profile.php of… |
CVE-2025-11354 | Medium | 6.3 | 2025-10-07 | A flaw has been found in code-projects Online Hotel Reservation System 1.0. Affected is an unknown function of the file /admin/addslideexec.php. Executing mani… |
CVE-2025-11353 | Medium | 6.3 | 2025-10-07 | A vulnerability was detected in code-projects Online Hotel Reservation System 1.0. This impacts an unknown function of the file /admin/addgalleryexec.php. Perf… |
CVE-2025-11352 | Medium | 6.3 | 2025-10-07 | A security vulnerability has been detected in code-projects Online Hotel Reservation System 1.0. This affects an unknown function of the file /admin/addexec.ph… |
CVE-2025-11351 | Medium | 6.3 | 2025-10-07 | A weakness has been identified in code-projects Online Hotel Reservation System 1.0. The impacted element is an unknown function of the file /admin/editpicexec… |
CVE-2025-11347 | High | 7.3 | 2025-10-07 | A vulnerability was found in code-projects Student Crud Operation up to 3.3. This vulnerability affects the function move_uploaded_file of the file add.php of… |
CVE-2025-61777 | Critical | 9.4 | 2025-10-06 | Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/badge-templates` (GET) and `/api/admin/b… |
CVE-2025-57247 | Critical | 9.1 | 2025-10-06 | The BATBToken smart contract (address 0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2, Compiler Version v0.8.26+commit.8a97fa7a) contains incorrect access control i… |
CVE-2025-11320 | Medium | 6.3 | 2025-10-06 | A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4. Impacted is the function uploadFile of the file src/main/java/com/… |
CVE-2025-11318 | High | 7.3 | 2025-10-06 | A security flaw has been discovered in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This vulnerability affects unknown code of the file u… |
CVE-2025-11281 | Medium | 5.0 | 2025-10-05 | A vulnerability has been found in Frappe LMS 2.35.0. The affected element is an unknown function of the file /courses/ of the component Unpublished Course Hand… |
CVE-2025-59943 | High | 8.1 | 2025-10-03 | phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of email addresses during user registration… |
CVE-2025-59951 | Critical | 9.1 | 2025-10-01 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The official Docker image for Termix versions 1… |
CVE-2025-58055 | Medium | 4.3 | 2025-10-01 | Discourse is an open-source community discussion platform. In versions 3.5.0 and below, the Discourse AI suggestion endpoints for topic “Title”, “Category”, an… |
CVE-2025-20366 | Medium | 6.5 | 2025-10-01 | In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.111, 9.3.2408.119, and 9.2.2406.122, a low-privi… |
CVE-2023-50300 | Medium | 5.1 | 2025-10-01 | IBM Transformation Extender Advanced 10.0.1 could allow a local user to perform unauthorized actions due to improper access controls. |
CVE-2025-10847 | | 2025-10-01 | DX Unified Infrastructure Management (Nimsoft/UIM) and below contains an improper ACL handling vulnerability in the robot (controller) component. A remote atta… | |
CVE-2025-55797 | Medium | 6.5 | 2025-09-30 | An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/[schemaId] endpoint allows unauthenticated attackers to access historica… |
CVE-2025-11163 | Medium | 4.3 | 2025-09-30 | The SmartCrawl SEO checker, analyzer & optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t… |
CVE-2025-54875 | Critical | 9.8 | 2025-09-29 | FreshRSS is a free, self-hostable RSS aggregator. In versions 1.16.0 and above through 1.26.3, an unprivileged attacker can create a new admin user when regist… |
CVE-2025-57266 | Critical | 9.8 | 2025-09-29 | An issue was discovered in file AssistantController.java in ThriveX Blogging Framework 2.5.9 thru 3.1.3 allowing unauthenticated attackers to gain sensitive in… |
CVE-2025-54591 | High | 7.5 | 2025-09-29 | FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below expose information about feeds and tags of default admin users, due to lack of acce… |
CVE-2025-57197 | Medium | 6.0 | 2025-09-29 | In the Payeer Android application 2.5.0, an improper access control vulnerability exists in the authentication flow for the PIN change feature. A local attacke… |
CVE-2025-55795 | Low | 3.5 | 2025-09-29 | The openml/openml.org web application version v2.0.20241110 uses incremental user IDs and insufficient email ownership verification during email update workflo… |
CVE-2025-36351 | Medium | 4.3 | 2025-09-29 | IBM License Metric Tool 9.2.0 through 9.2.40 could allow an authenticated user to bypass access controls in the REST API interface and perform unauthorized a… |
CVE-2025-57428 | Medium | 6.5 | 2025-09-29 | Default credentials in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to gain access to the debug shell exposed via… |
CVE-2025-11136 | Medium | 4.7 | 2025-09-29 | A flaw has been found in YiFang CMS up to 2.0.2. The impacted element is the function webUploader of the file app/app/controller/File.php of the component Back… |
CVE-2025-11103 | Medium | 4.7 | 2025-09-28 | A security vulnerability has been detected in Projectworlds Online Tours and Travels 1.0. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2025-11078 | Medium | 6.3 | 2025-09-27 | A vulnerability was identified in itsourcecode Open Source Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/user/c… |
CVE-2025-59932 | High | 8.6 | 2025-09-27 | Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests w… |
CVE-2025-11028 | Medium | 5.3 | 2025-09-26 | A security flaw has been discovered in givanz Vvveb up to 1.0.7.2. This affects an unknown part of the component Image Handler. Performing manipulation results… |
CVE-2025-11026 | Low | 3.5 | 2025-09-26 | A vulnerability was determined in givanz Vvveb up to 1.0.7.2. Affected by this vulnerability is an unknown functionality of the component Configuration File Ha… |
CVE-2025-48707 | High | 7.5 | 2025-09-25 | An issue was discovered in Stormshield Network Security (SNS) before 5.0.1. TPM authentication information could, in some HA use cases, be shared among adminis… |
CVE-2025-10952 | Medium | 5.3 | 2025-09-25 | A security flaw has been discovered in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected by this issue is the function stream_handler o… |
CVE-2025-59422 | Low | 3.1 | 2025-09-25 | Dify is an open-source LLM app development platform. In version 1.8.1, a broken access control vulnerability on the /console/api/apps/<APP_ID>chat-messages?con… |
CVE-2025-10957 | | 2025-09-25 | This vulnerability exists in the Syrotech SY-GPON-2010-WADONT router due to improper access control in its FTP service. A remote attacker could exploit this vu… | |
CVE-2025-56241 | High | 7.5 | 2025-09-24 | Aztech DSL5005EN firmware 1.00.AZ_2013-05-10 and possibly other versions allows unauthenticated attackers to change the administrator password via a crafted PO… |
CVE-2025-48869 | High | 7.5 | 2025-09-24 | Horilla is a free and open source Human Resource Management System (HRMS). Unauthenticated users can access uploaded resume files in Horilla 1.3.0 by directly… |
CVE-2025-20316 | Medium | 5.3 | 2025-09-24 | A vulnerability in the access control list (ACL) programming of Cisco IOS XE Software for Cisco Catalyst 9500X and 9600X Series Switches could allow an unauthe… |
CVE-2025-20339 | Medium | 5.8 | 2025-09-24 | A vulnerability in the access control list (ACL) processing of IPv4 packets of Cisco SD-WAN vEdge Software could allow an unauthenticated, remote attacker to b… |
CVE-2025-7106 | Medium | 5.3 | 2025-09-23 | danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. The `checkAccess` function in `api/server/mid… |
CVE-2025-59434 | Critical | 9.6 | 2025-09-22 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to August 2025 Cloud-Hosted Flowise, an authenticated vulnerabil… |
CVE-2025-57438 | Medium | 6.8 | 2025-09-22 | The 2wcom IP-4c 2.15.5 device suffers from a Broken Access Control vulnerability. Certain sensitive endpoints are intended to be accessible only after the admi… |
CVE-2025-5962 | High | 7.7 | 2025-09-22 | A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of… |