CWE-284 · Improper Access Control (page 45)
Page 45 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-53113 | Low | 2.7 | 2025-07-30 | GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, l… |
CVE-2025-53112 | Medium | 4.3 | 2025-07-30 | GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.1.0 t… |
CVE-2025-53111 | Medium | 6.5 | 2025-07-30 | GLPI is a Free Asset and IT Management Software package. In versions 0.80 through 10.0.18, a lack of permission checks can result in unauthorized access to som… |
CVE-2025-43270 | High | 8.8 | 2025-07-30 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An ap… |
CVE-2025-43241 | Medium | 5.5 | 2025-07-30 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app ma… |
CVE-2025-43233 | Critical | 9.8 | 2025-07-30 | This issue was addressed with improved access restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. A malicious a… |
CVE-2025-43232 | Critical | 9.8 | 2025-07-30 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app ma… |
CVE-2025-43198 | Critical | 9.8 | 2025-07-30 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. An app may be able to access protecte… |
CVE-2025-43194 | Critical | 9.8 | 2025-07-30 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to modif… |
CVE-2025-43192 | Critical | 9.8 | 2025-07-30 | A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. Account-driven User Enrollmen… |
CVE-2025-43184 | Critical | 9.8 | 2025-07-30 | This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.7, macOS Ventura 13.7.7… |
CVE-2024-42655 | High | 8.8 | 2025-07-29 | An access control issue in NanoMQ v0.21.10 allows attackers to bypass security restrictions and access sensitive system topic messages using MQTT wildcard char… |
CVE-2025-30133 | Critical | 9.8 | 2025-07-28 | An issue was discovered on IROAD Dashcam FX2 devices. Bypass of Device Pairing/Registration can occur. It requires device registration via the "IROAD X View" a… |
CVE-2025-27724 | Critical | 9.3 | 2025-07-28 | A privilege escalation vulnerability exists in the login.php functionality of meddream MedDream PACS Premium 7.3.3.840. A specially crafted .php file can lead… |
CVE-2025-8265 | Medium | 4.7 | 2025-07-28 | A vulnerability classified as critical has been found in 299Ko CMS 2.0.0. This affects an unknown part of the file /admin/filemanager/view of the component Fil… |
CVE-2025-8256 | Medium | 6.3 | 2025-07-28 | A vulnerability classified as critical has been found in code-projects Online Ordering System 1.0. Affected is an unknown function of the file /admin/product.p… |
CVE-2025-8255 | High | 7.3 | 2025-07-28 | A vulnerability was found in code-projects Exam Form Submission 1.0. It has been rated as critical. This issue affects some unknown processing of the file /reg… |
CVE-2025-8226 | Medium | 4.3 | 2025-07-27 | A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been classified as problematic. Affected is an unknown function of the file /sysApp/find… |
CVE-2025-8174 | Medium | 6.3 | 2025-07-26 | A vulnerability was found in code-projects Voting System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admi… |
CVE-2025-8171 | Medium | 6.3 | 2025-07-25 | A vulnerability, which was classified as critical, has been found in code-projects Document Management System 1.0. This issue affects some unknown processing o… |
CVE-2025-43712 | Low | 2.9 | 2025-07-25 | JHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter. Upon registering in the JHipster portal and logging in as a standard… |
CVE-2025-8128 | Medium | 6.3 | 2025-07-25 | A vulnerability, which was classified as critical, has been found in zhousg letao up to 7d8df0386a65228476290949e0413de48f7fbe98. This issue affects some unkno… |
CVE-2025-6741 | High | 7.7 | 2025-07-22 | Improper access control in secure message component in Devolutions Server allows an authenticated user to steal unauthorized entries via the secure message ent… |
CVE-2025-7939 | Medium | 6.3 | 2025-07-21 | A vulnerability was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 1.0. It has been classified as critical. Affected is the function addGoods of the file GoodsCo… |
CVE-2025-44654 | Critical | 9.8 | 2025-07-21 | In Linksys E2500 3.0.04.002, the chroot_local_user option is enabled in the vsftpd configuration file. This could lead to unauthorized access to system files… |
CVE-2025-7931 | High | 7.3 | 2025-07-21 | A vulnerability was found in code-projects Church Donation System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of t… |
CVE-2025-44657 | Low | 3.9 | 2025-07-21 | In Linksys EA6350 V2.1.2, the chroot_local_user option is enabled in the dynamically generated vsftpd configuration file. This could lead to unauthorized acces… |
CVE-2025-46118 | Medium | 5.3 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139 and in Ruckus ZoneDirector prior to 10.5.1.0.279, where hard-… |
CVE-2025-7906 | Medium | 6.3 | 2025-07-20 | A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1 and classified as critical. This issue affects the function uploadFile of the file ruoyi-admin/src… |
CVE-2025-7898 | Medium | 4.7 | 2025-07-20 | A vulnerability was found in Codecanyon iDentSoft 2.0. It has been classified as critical. This affects an unknown part of the file /clinica/profile/updateSett… |
CVE-2025-7895 | Medium | 6.3 | 2025-07-20 | A vulnerability, which was classified as critical, was found in harry0703 MoneyPrinterTurbo up to 1.2.6. Affected is the function upload_bgm_file of the file a… |
CVE-2025-7880 | Medium | 6.3 | 2025-07-20 | A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2 and classified as critical. Affected by this issue is some unknown functionality of the file /bu… |
CVE-2025-7879 | Medium | 6.3 | 2025-07-20 | A vulnerability has been found in Metasoft 美特软件 MetaCRM up to 6.4.2 and classified as critical. Affected by this vulnerability is an unknown functionality of t… |
CVE-2025-7878 | Medium | 6.3 | 2025-07-20 | A vulnerability, which was classified as critical, was found in Metasoft 美特软件 MetaCRM up to 6.4.2. Affected is an unknown function of the file /common/jsp/uplo… |
CVE-2025-7877 | Medium | 6.3 | 2025-07-20 | A vulnerability, which was classified as critical, has been found in Metasoft 美特软件 MetaCRM up to 6.4.2. This issue affects some unknown processing of the file… |
CVE-2025-7874 | Medium | 5.3 | 2025-07-20 | A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the f… |
CVE-2025-7864 | Medium | 6.3 | 2025-07-20 | A vulnerability was found in thinkgem JeeSite up to 5.12.0. It has been classified as critical. This affects the function Upload of the file src/main/java/com/… |
CVE-2025-52168 | Medium | 6.5 | 2025-07-18 | Incorrect access control in the dynawebservice component of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows unauthenticated attackers to access… |
CVE-2025-52166 | Medium | 6.5 | 2025-07-18 | Incorrect access control in Software GmbH Agorum core open v11.9.2 & v11.10.1 allows authenticated attackers to escalate privileges to Administrator and access… |
CVE-2025-45157 | Medium | 6.5 | 2025-07-18 | Insecure permissions in Splashin iOS v2.0 allow unauthorized attackers to access location data for specific users. |
CVE-2024-32124 | Medium | 4.3 | 2025-07-18 | An improper access control vulnerability [CWE-284] in FortiIsolator version 2.4.4, version 2.4.3, 2.3 all versions logging component may allow a remote authent… |
CVE-2025-7755 | Medium | 6.3 | 2025-07-17 | A vulnerability was found in code-projects Online Ordering System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /a… |
CVE-2025-53028 | High | 8.2 | 2025-07-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.1.10. Easily exploi… |
CVE-2025-50108 | Medium | 5.4 | 2025-07-15 | Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Workspace). The supported version that is affected is 11.2.20… |
CVE-2025-50107 | Medium | 6.1 | 2025-07-15 | Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Request handling). Supported versions that are affected are 12… |
CVE-2025-50105 | High | 8.1 | 2025-07-15 | Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Administration). Supported versions that are aff… |
CVE-2025-50087 | Medium | 4.9 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 a… |
CVE-2025-50081 | Low | 3.1 | 2025-07-15 | Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 a… |
CVE-2025-50072 | Medium | 4.0 | 2025-07-15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1… |
CVE-2025-50071 | Medium | 6.4 | 2025-07-15 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities). Supported versions that are affected are 12… |
CVE-2025-50070 | Medium | 5.3 | 2025-07-15 | Vulnerability in the JDBC component of Oracle Database Server. Supported versions that are affected are 23.4-23.8. Difficult to exploit vulnerability allows l… |
CVE-2025-50060 | High | 8.1 | 2025-07-15 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 7.6.0.0.0, 8.2.0.0.0 an… |
CVE-2025-50059 | High | 8.6 | 2025-07-15 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported ve… |
CVE-2025-30760 | Medium | 5.4 | 2025-07-15 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0… |
CVE-2025-30759 | Medium | 6.1 | 2025-07-15 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). Supported versions that are a… |
CVE-2025-30754 | Medium | 4.8 | 2025-07-15 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions… |
CVE-2025-7627 | Medium | 6.3 | 2025-07-14 | A vulnerability was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical. Affected by this issue… |
CVE-2025-7576 | High | 7.3 | 2025-07-14 | A vulnerability was found in Teledyne FLIR FB-Series O and FLIR FH-Series ID 1.3.2.16 and classified as critical. Affected by this issue is some unknown functi… |
CVE-2025-7573 | Medium | 5.3 | 2025-07-14 | A vulnerability, which was classified as critical, has been found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 202… |
CVE-2025-7572 | Medium | 5.3 | 2025-07-14 | A vulnerability classified as critical was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. This vulne… |
CVE-2025-7565 | Medium | 5.3 | 2025-07-14 | A vulnerability, which was classified as critical, was found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function geteasycfg of the file /cgi-bin/light… |
CVE-2025-7552 | Medium | 6.3 | 2025-07-14 | A vulnerability was found in Dromara Northstar up to 7.3.5. It has been rated as critical. Affected by this issue is the function preHandle of the file northst… |
CVE-2025-7547 | High | 7.3 | 2025-07-13 | A vulnerability, which was classified as critical, was found in Campcodes Online Movie Theater Seat Reservation System 1.0. This affects the function save_movi… |
CVE-2025-7538 | High | 7.3 | 2025-07-13 | A vulnerability classified as critical was found in Campcodes Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/produc… |
CVE-2025-7487 | Medium | 6.3 | 2025-07-12 | A vulnerability, which was classified as critical, was found in JoeyBling SpringBoot_MyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26. This affects t… |
CVE-2025-7477 | Medium | 4.7 | 2025-07-12 | A vulnerability, which was classified as critical, has been found in code-projects Simple Car Rental System 1.0. This issue affects some unknown processing of… |
CVE-2025-7470 | High | 7.3 | 2025-07-12 | A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been classified as critical. Affected is an unknown function of the file /pages/p… |
CVE-2025-52963 | Medium | 5.5 | 2025-07-11 | An Improper Access Control vulnerability in the User Interface (UI) of Juniper Networks Junos OS allows a local, low-privileged attacker to bring down an inter… |
CVE-2025-7413 | Medium | 6.3 | 2025-07-10 | A vulnerability classified as critical has been found in code-projects Library System 1.0. This affects an unknown part of the file /user/teacher/profile.php… |
CVE-2025-7412 | Medium | 6.3 | 2025-07-10 | A vulnerability was found in code-projects Library System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2025-23048 | Critical | 9.1 | 2025-07-10 | In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session re… |
CVE-2025-44525 | Medium | 6.5 | 2025-07-09 | Texas Instruments CC2652RB LaunchPad SimpleLink CC13XX CC26XX SDK 7.41.00.17 was discovered to utilize insufficient permission checks on critical fields within… |
CVE-2025-44526 | Medium | 6.5 | 2025-07-09 | Realtek RTL8762EKF-EVB RTL8762E SDK V1.4.0 was discovered to utilize insufficient permission checks on critical fields within Bluetooth Low Energy (BLE) data p… |
CVE-2025-7210 | Medium | 6.3 | 2025-07-09 | A vulnerability was found in code-projects/Fabian Ros Library Management System 2.0 and classified as critical. Affected by this issue is some unknown function… |
CVE-2025-49546 | Low | 2.4 | 2025-07-08 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Access Control vulnerability that could lead to a partial application deni… |
CVE-2025-7190 | Medium | 6.3 | 2025-07-08 | A vulnerability, which was classified as critical, was found in code-projects Library Management System 2.0. This affects an unknown part of the file /admin/st… |
CVE-2025-48817 | High | 8.8 | 2025-07-08 | Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
CVE-2025-47993 | High | 7.8 | 2025-07-08 | Improper access control in Microsoft PC Manager allows an authorized attacker to elevate privileges locally. |
CVE-2025-7181 | Medium | 6.3 | 2025-07-08 | A vulnerability, which was classified as critical, was found in code-projects Staff Audit System 1.0. Affected is an unknown function of the file /test.php. Th… |
CVE-2025-7175 | Medium | 6.3 | 2025-07-08 | A vulnerability was found in code-projects E-Commerce Site 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/users_ph… |
CVE-2025-23365 | High | 7.8 | 2025-07-08 | A vulnerability has been identified in TIA Administrator (All versions < V3.0.6). The affected application allows low-privileged users to trigger installations… |
CVE-2025-7152 | Medium | 6.3 | 2025-07-08 | A vulnerability classified as critical has been found in Campcodes Advanced Online Voting System 1.0. Affected is an unknown function of the file /admin/candid… |
CVE-2025-7151 | Medium | 6.3 | 2025-07-07 | A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2025-20324 | Medium | 5.4 | 2025-07-07 | In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.7, and 9.1.10 and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, a lo… |
CVE-2025-20323 | Medium | 4.3 | 2025-07-07 | In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could turn of… |
CVE-2025-7124 | Medium | 6.3 | 2025-07-07 | A vulnerability classified as critical has been found in code-projects Online Note Sharing 1.0. Affected is an unknown function of the file /dashboard/userprof… |
CVE-2025-7100 | Medium | 6.3 | 2025-07-07 | A vulnerability was found in BoyunCMS up to 1.4.20 and classified as critical. Affected by this issue is some unknown functionality of the file /application/us… |
CVE-2025-7076 | Medium | 5.4 | 2025-07-06 | A vulnerability was found in BlackVue Dashcam 590X up to 20250624. It has been rated as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2025-7075 | Medium | 6.3 | 2025-07-06 | A vulnerability was found in BlackVue Dashcam 590X up to 20250624. It has been declared as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2025-6786 | Medium | 5.3 | 2025-07-04 | The DocCheck Login plugin for WordPress is vulnerable to unauthorized post access in all versions up to, and including, 1.1.5. This is due to plugin redirectin… |
CVE-2025-53501 | High | 8.8 | 2025-07-03 | Improper Access Control vulnerability in Wikimedia Foundation Mediawiki - Scribunto Extension allows : Accessing Functionality Not Properly Constrained by Auth… |
CVE-2025-45424 | Medium | 5.3 | 2025-07-02 | Incorrect access control in Xinference before v1.4.0 allows attackers to access the Web GUI without authentication. |
CVE-2025-52101 | Critical | 9.8 | 2025-07-01 | linjiashop <=0.9 is vulnerable to Incorrect Access Control. When using the default-generated JWT authentication, attackers can bypass the authentication and re… |
CVE-2025-27153 | Medium | 6.5 | 2025-07-01 | Escalade GLPI plugin is a ticket escalation process helper for GLPI. Prior to version 2.9.11, there is an improper access control vulnerability. This can lead… |
CVE-2025-45083 | Medium | 6.1 | 2025-07-01 | Incorrect access control in Ullu (Android version v2.9.929 and IOS version v2.8.0) allows attackers to bypass parental pin feature via unspecified vectors. |
CVE-2025-45081 | High | 8.8 | 2025-07-01 | Misconfigured settings in IITB SSO v1.1.0 allow attackers to access sensitive application data. |
CVE-2025-50405 | Medium | 6.5 | 2025-07-01 | Intelbras RX1500 Router v2.2.17 and before is vulnerable to Incorrect Access Control in the FirmwareUpload function and GetFirmwareValidation function. |
CVE-2025-53003 | | 2025-07-01 | The Janssen Project is an open-source identity and access management (IAM) platform. Prior to version 1.8.0, the Config API returns results without scope verif… | |
CVE-2025-6900 | Medium | 6.3 | 2025-06-30 | A vulnerability has been found in code-projects Library System 1.0 and classified as critical. This vulnerability affects unknown code of the file /add-book.ph… |
CVE-2025-46014 | High | 8.8 | 2025-06-30 | Several services in Honor Device Co., Ltd Honor PC Manager v16.0.0.118 was discovered to connect services to the named pipe iMateBookAssistant with default or… |