CWE-284 · Improper Access Control (page 44)
Page 44 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9476 | High | 7.3 | 2025-08-26 | A vulnerability has been found in SourceCodester Human Resource Information System 1.0. Affected by this issue is some unknown functionality of the file /Super… |
CVE-2025-9475 | High | 7.3 | 2025-08-26 | A flaw has been found in SourceCodester Human Resource Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /Admin_Da… |
CVE-2025-9461 | Medium | 4.3 | 2025-08-26 | A weakness has been identified in diyhi bbs up to 6.8. The impacted element is an unknown function of the file src/main/java/cms/web/action/filePackage/FilePac… |
CVE-2025-9415 | Medium | 6.3 | 2025-08-25 | A vulnerability was identified in GreenCMS up to 2.3.0603. This affects an unknown part of the file /index.php?m=admin&c=media&a=fileconnect. The manipulation… |
CVE-2025-29421 | High | 7.5 | 2025-08-25 | PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the getThemeFileContent function. |
CVE-2025-50900 | Critical | 9.8 | 2025-08-25 | An issue was discovered in getrebuild/rebuild 4.0.4. The affected source code class is com.rebuild.web.RebuildWebInterceptor, and the affected function is preH… |
CVE-2025-44178 | Medium | 6.5 | 2025-08-25 | DASAN GPON ONU H660WM H660WMR210825 is susceptible to improper access control under its default settings. Attackers can exploit this vulnerability to gain unau… |
CVE-2025-29524 | Medium | 6.5 | 2025-08-25 | Incorrect access control in the component /cgi-bin/system_diagnostic_main.asp of DASAN GPON ONU H660WM H660WMR210825 allows attackers to access sensitive infor… |
CVE-2025-29520 | Medium | 5.3 | 2025-08-25 | Incorrect access control in the Maintenance module of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows authenticated attackers with low-level p… |
CVE-2024-46412 | Medium | 6.5 | 2025-08-25 | Incorrect access control in the prehandle function of Rebuild v3.7.7 allows attackers to bypass authentication via a crafted GET request sent to /commons/ip-lo… |
CVE-2025-29515 | Critical | 9.8 | 2025-08-25 | Incorrect access control in the DELT_file.xgi endpoint of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to modify arbitrary settin… |
CVE-2025-29514 | Critical | 9.8 | 2025-08-25 | Incorrect access control in the config.xgi function of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to download the configuration… |
CVE-2025-9406 | Medium | 6.3 | 2025-08-25 | A weakness has been identified in xuhuisheng lemon up to 1.13.0. This affects the function uploadImage of the file CmsArticleController.java of the component c… |
CVE-2025-9400 | Medium | 6.3 | 2025-08-25 | A flaw has been found in YiFang CMS up to 2.0.5. This affects the function mergeMultipartUpload of the file app/utils/base/plugin/P_file.php. This manipulation… |
CVE-2025-9398 | Medium | 5.3 | 2025-08-25 | A security vulnerability has been detected in YiFang CMS up to 2.0.5. Affected by this vulnerability is the function exportInstallTable of the file app/utils/b… |
CVE-2025-9397 | Medium | 6.3 | 2025-08-24 | A weakness has been identified in givanz Vvveb up to 1.0.7.2. Affected is an unknown function of the file /system/traits/media.php. Executing manipulation of t… |
CVE-2025-9381 | Low | 1.6 | 2025-08-24 | A security flaw has been discovered in FNKvision Y215 CCTV Camera 10.194.120.40. This affects an unknown part of the file /tmp/wpa_supplicant.conf. Performing… |
CVE-2022-43110 | Critical | 9.8 | 2025-08-22 | Voltronic Power ViewPower through 1.04-21353 and PowerShield Netguard before 1.04-23292 allows a remote attacker to configure the system via an unspecified web… |
CVE-2024-53496 | Critical | 9.8 | 2025-08-22 | Incorrect access control in the doFilter function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication. |
CVE-2025-55630 | High | 7.3 | 2025-08-22 | A discrepancy in the error message returned by the login function of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_250312228… |
CVE-2025-55626 | Medium | 5.3 | 2025-08-22 | An Insecure Direct Object Reference (IDOR) vulnerability in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allows… |
CVE-2024-53494 | High | 7.5 | 2025-08-22 | Incorrect access control in the preHandle function of SpringBootBlog v1.0.0 allows attackers to access sensitive components without authentication. |
CVE-2025-55741 | High | 8.1 | 2025-08-22 | UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. In versions 0.3.0 and earlier, users without the Delete pr… |
CVE-2025-53763 | Critical | 9.8 | 2025-08-21 | Improper access control in Azure Databricks allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-7051 | High | 8.3 | 2025-08-21 | On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerabil… |
CVE-2024-45438 | Critical | 9.1 | 2025-08-21 | An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14. The file quarantine.php within the SpamTi… |
CVE-2025-55371 | Medium | 5.3 | 2025-08-21 | Incorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows unauthorized attackers to obtain all the information of the h… |
CVE-2025-55368 | High | 8.8 | 2025-08-21 | Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier statu… |
CVE-2025-55367 | Medium | 5.3 | 2025-08-21 | Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier s… |
CVE-2025-55366 | Medium | 5.3 | 2025-08-21 | Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execu… |
CVE-2025-9296 | Medium | 4.7 | 2025-08-21 | A security vulnerability has been detected in Emlog Pro up to 2.5.18. This affects an unknown function of the file /admin/blogger.php?action=update_avatar. Suc… |
CVE-2025-27215 | High | 8.1 | 2025-08-21 | An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect Display Cast devices to make unsupported changes to… |
CVE-2024-57155 | Critical | 9.8 | 2025-08-20 | Incorrect access control in radar v1.0.8 allows attackers to bypass authentication and access sensitive APIs without a token. |
CVE-2024-57154 | Critical | 9.8 | 2025-08-20 | Incorrect access control in dts-shop v0.0.1-SNAPSHOT allows attackers to bypass authentication via sending a crafted payload to /admin/auth/index. |
CVE-2025-9240 | Medium | 4.3 | 2025-08-20 | A security flaw has been discovered in elunez eladmin up to 2.7. Affected by this issue is some unknown functionality of the file /auth/info. The manipulation… |
CVE-2024-57152 | High | 7.5 | 2025-08-20 | Incorrect access control in the preHandle function of my-site v1.0.2 allows attackers to access sensitive components without authentication via the cn.luischen… |
CVE-2024-53495 | High | 7.5 | 2025-08-20 | Incorrect access control in the preHandle function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication. |
CVE-2025-28041 | High | 8.6 | 2025-08-20 | Incorrect access control in the doFilter function of itranswarp up to 2.19 allows attackers to access sensitive components without authentication. |
CVE-2025-20131 | Medium | 4.9 | 2025-08-20 | A vulnerability in the GUI of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative privileges to upload files… |
CVE-2024-57157 | Critical | 9.8 | 2025-08-20 | Incorrect access control in Jantent v1.1 allows attackers to bypass authentication and access sensitive APIs without a token. |
CVE-2025-9153 | Medium | 6.3 | 2025-08-19 | A vulnerability was detected in itsourcecode Online Tour and Travel Management System 1.0. This vulnerability affects unknown code of the file /admin/operation… |
CVE-2025-51539 | Medium | 5.3 | 2025-08-19 | EzGED3 3.5.0 contains an unauthenticated arbitrary file read vulnerability due to improper access control and insufficient input validation in a script exposed… |
CVE-2025-50434 | Medium | 5.3 | 2025-08-19 | A security issue has been identified in Appian Enterprise Business Process Management version 25.3. The vulnerability is related to incorrect access control, w… |
CVE-2025-51529 | Medium | 5.3 | 2025-08-19 | Incorrect Access Control in the AJAX endpoint functionality in jonkastonka Cookies and Content Security Policy plugin through version 2.29 allows remote attack… |
CVE-2025-50897 | Medium | 4.3 | 2025-08-19 | A vulnerability exists in riscv-boom SonicBOOM 1.2 (BOOMv1.2) processor implementation, where valid virtual-to-physical address translations configured with wr… |
CVE-2025-9139 | Medium | 4.3 | 2025-08-19 | A vulnerability was determined in Scada-LTS 2.7.8.1. Affected by this vulnerability is an unknown functionality of the file /Scada-LTS/dwr/call/plaincall/Watch… |
CVE-2025-32992 | High | 8.5 | 2025-08-18 | Thermo Fisher Scientific ePort through 3.0.0 has Incorrect Access Control. |
CVE-2025-4962 | High | 7.7 | 2025-08-18 | An Insecure Direct Object Reference (IDOR) vulnerability was identified in the `POST /v1/templates` endpoint of the Lunary API, affecting versions up to 0.8.8… |
CVE-2025-9099 | Medium | 6.3 | 2025-08-18 | A vulnerability was identified in Acrel Environmental Monitoring Cloud Platform up to 20250804. This affects an unknown part of the file /NewsManage/UploadNews… |
CVE-2017-20199 | Low | 3.1 | 2025-08-16 | A vulnerability was found in Buttercup buttercup-browser-extension up to 0.14.2. Affected by this vulnerability is an unknown functionality of the component Va… |
CVE-2025-50861 | Medium | 6.5 | 2025-08-14 | The Lotus Cars Android app (com.lotus.carsdomestic.intl) 1.2.8 contains an exported component, PushDeepLinkActivity, which is accessible without authentication… |
CVE-2025-20219 | Medium | 5.3 | 2025-08-14 | A vulnerability in the implementation of access control rules for loopback interfaces in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and C… |
CVE-2025-8965 | Medium | 6.3 | 2025-08-14 | A vulnerability has been found in linlinjava litemall up to 1.8.0. This vulnerability affects the function create of the file litemall-admin-api/src/main/java/… |
CVE-2025-48861 | Medium | 5.3 | 2025-08-14 | A vulnerability in the Task API endpoint of the ctrlX OS setup mechanism allowed a remote, unauthenticated attacker to access and extract internal application… |
CVE-2025-48860 | High | 8.0 | 2025-08-14 | A vulnerability in the web application of the ctrlX OS setup mechanism facilitated an authenticated (low privileged) attacker to gain remote access to backup a… |
CVE-2025-55196 | | 2025-08-13 | External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability wa… | |
CVE-2025-8762 | Medium | 6.8 | 2025-08-13 | A vulnerability was found in INSTAR 2K+ and 4K 3.11.1 Build 1124. This issue affects some unknown processing of the component UART Interface. The manipulation… |
CVE-2025-53729 | High | 7.8 | 2025-08-12 | Improper access control in Azure File Sync allows an authorized attacker to elevate privileges locally. |
CVE-2025-49707 | High | 7.9 | 2025-08-12 | Improper access control in Azure Virtual Machines allows an authorized attacker to perform spoofing locally. |
CVE-2025-24999 | High | 8.8 | 2025-08-12 | Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network. |
CVE-2025-24840 | Medium | 5.8 | 2025-08-12 | Improper access control for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an unauthenticated user to po… |
CVE-2025-24323 | Medium | 6.5 | 2025-08-12 | Improper access control in some firmware package and LED mode toggle tool for some Intel(R) PCIe Switch software before version MR4_1.0b1 may allow a privilege… |
CVE-2025-24313 | Medium | 4.4 | 2025-08-12 | Improper access control for some Device Plugins for Kubernetes software maintained by Intel before version 0.32.0 may allow a privileged user to potentially en… |
CVE-2025-20099 | Medium | 6.7 | 2025-08-12 | Improper access control for some Intel(R) Rapid Storage Technology installation software may allow an authenticated user to potentially enable escalation of pr… |
CVE-2025-55012 | | 2025-08-11 | Zed is a multiplayer code editor. Prior to version 0.197.3, in the Zed Agent Panel allowed for an AI agent to achieve Remote Code Execution (RCE) by bypassing… | |
CVE-2025-8859 | Medium | 6.3 | 2025-08-11 | A vulnerability was identified in code-projects eBlog Site 1.0. Affected by this vulnerability is an unknown functionality of the file /native/admin/save-slide… |
CVE-2025-8841 | Medium | 6.3 | 2025-08-11 | A vulnerability was identified in zlt2000 microservices-platform up to 6.0.0. Affected by this vulnerability is the function Upload of the file zlt-business/fi… |
CVE-2025-8798 | High | 7.3 | 2025-08-10 | A vulnerability was found in oitcode samarium up to 0.9.6. It has been classified as critical. Affected is an unknown function of the file /dashboard/product o… |
CVE-2025-8795 | Medium | 6.3 | 2025-08-10 | A vulnerability, which was classified as critical, was found in LitmusChaos Litmus up to 3.19.0. This affects an unknown part of the file /auth/login. The mani… |
CVE-2025-8775 | Medium | 6.3 | 2025-08-09 | A vulnerability was found in Qiyuesuo Eelectronic Signature Platform up to 4.34 and classified as critical. Affected by this issue is the function execute of t… |
CVE-2025-8764 | Medium | 6.3 | 2025-08-09 | A vulnerability classified as critical has been found in linlinjava litemall up to 1.8.0. Affected is the function Upload of the file /wx/storage/upload. The m… |
CVE-2025-8738 | Medium | 5.3 | 2025-08-08 | A vulnerability has been found in zlt2000 microservices-platform up to 6.0.0 and classified as problematic. This vulnerability affects unknown code of the file… |
CVE-2025-54397 | Medium | 4.3 | 2025-08-07 | Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 inserts Sensitive Information Into Sent Data to authenticated users. |
CVE-2024-42048 | Medium | 6.5 | 2025-08-07 | OpenOrange Business Framework version 1.15.5 installs to a directory with overly permissive access control, allowing all authenticated users to write to the in… |
CVE-2025-54786 | Medium | 5.3 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authenticati… |
CVE-2025-51054 | Medium | 6.5 | 2025-08-06 | Vedo Suite 2024.17 is vulnerable to Incorrect Access Control, which allows remote attackers to obtain a valid high privilege JWT token without prior authentica… |
CVE-2024-55402 | Medium | 5.3 | 2025-08-06 | 4C Strategies Exonaut before v22.4 was discovered to contain an access control issue. |
CVE-2025-30127 | Critical | 9.8 | 2025-08-06 | An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. Once access is gained either by default, common, or cracked passwords, the video recordings… |
CVE-2025-51532 | High | 7.5 | 2025-08-06 | Incorrect access control in Sage DPW 2024_12_004 and earlier allows unauthorized attackers to access the built-in Database Monitor via a crafted request. The v… |
CVE-2025-46391 | Medium | 6.5 | 2025-08-06 | CWE-284: Improper Access Control |
CVE-2025-27062 | High | 7.8 | 2025-08-06 | Memory corruption while handling client exceptions, allowing unauthorized channel access. |
CVE-2025-51627 | Medium | 6.5 | 2025-08-05 | Incorrect access control in CaricaVerbale in Agenzia Impresa Eccobook v2.81.1 allows authenticated attackers with low-level access to escalate privileges to Ad… |
CVE-2025-51060 | Medium | 6.5 | 2025-08-05 | An issue was discovered in CPUID cpuz.sys 1.0.5.4. An attacker can use DeviceIoControl with the unvalidated parameters 0x9C402440 and 0x9C402444 as IoControlCo… |
CVE-2025-43980 | Medium | 6.5 | 2025-08-05 | An issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN. They enable the SSH service by default with the credentials of root/admin. The GUI does… |
CVE-2025-54871 | Medium | 5.5 | 2025-08-05 | Electron Capture facilitates video playback for screen-sharing and capture. In versions 2.19.1 and below, the elecap app on macOS allows local unprivileged use… |
CVE-2025-8526 | Medium | 6.3 | 2025-08-04 | A vulnerability was found in Exrick xboot up to 3.3.4. It has been declared as critical. This vulnerability affects the function Upload of the file xboot-fast/… |
CVE-2025-8525 | Medium | 5.3 | 2025-08-04 | A vulnerability was found in Exrick xboot up to 3.3.4. It has been classified as problematic. This affects an unknown part of the component Spring Boot Admin/S… |
CVE-2025-8519 | Low | 2.7 | 2025-08-04 | A vulnerability classified as problematic has been found in givanz Vvveb up to 1.0.5. This affects an unknown part of the file /vadmin123/index.php?module=edit… |
CVE-2025-8515 | Low | 3.1 | 2025-08-04 | A weakness has been identified in Intelbras InControl 2.21.60.9. This vulnerability affects unknown code of the file /v1/operador/ of the component JSON Endpoi… |
CVE-2025-8504 | Medium | 6.3 | 2025-08-03 | A vulnerability, which was classified as critical, was found in code-projects Kitchen Treasure 1.0. This affects an unknown part of the file /userregistration… |
CVE-2025-23277 | High | 7.3 | 2025-08-02 | NVIDIA Display Driver for Linux and Windows contains a vulnerability in the kernel mode driver, where an attacker could access memory outside bounds permitted… |
CVE-2025-50870 | Critical | 9.8 | 2025-08-01 | Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint. The myds GET parameter accepts an email addre… |
CVE-2025-26062 | Critical | 9.8 | 2025-07-31 | An access control issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to access the router's settings file and obtain potentia… |
CVE-2025-50850 | High | 8.6 | 2025-07-31 | An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such as CAPTCHA verification and rate limitin… |
CVE-2025-29556 | High | 7.3 | 2025-07-31 | ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control. Since version 6.3, ExaGrid enforces restrictions preventing users with the Admin role f… |
CVE-2025-52289 | High | 8.0 | 2025-07-31 | A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbi… |
CVE-2025-29557 | Medium | 5.4 | 2025-07-31 | ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control in the MailConfiguration API endpoint, where users with operator-level privileges can is… |
CVE-2025-8379 | Medium | 4.7 | 2025-07-31 | A vulnerability classified as critical has been found in Campcodes Online Hotel Reservation System 1.0. This affects an unknown part of the file /admin/edit_ro… |
CVE-2025-8344 | Medium | 6.3 | 2025-07-31 | A vulnerability classified as critical has been found in openviglet shio up to 0.3.8. Affected is the function shStaticFileUpload of the file shio-app/src/main… |
CVE-2025-50777 | High | 7.8 | 2025-07-30 | The firmware of the AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera (version V1.00.02) contains an Incorrect Access Control vulnerability that allows l… |