CWE-285 · Improper Authorization (page 7)
Page 7 of 16 — CVEs classified under CWE-285, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-10980 | Medium | 4.3 | 2025-09-26 | A security vulnerability has been detected in JeecgBoot up to 3.8.2. This affects an unknown function of the file /sys/position/exportXls. Such manipulation le… |
CVE-2025-10979 | Medium | 4.3 | 2025-09-25 | A weakness has been identified in JeecgBoot up to 3.8.2. The impacted element is an unknown function of the file /sys/role/exportXls. This manipulation causes… |
CVE-2025-10978 | Medium | 4.3 | 2025-09-25 | A security flaw has been discovered in JeecgBoot up to 3.8.2. The affected element is an unknown function of the file /sys/user/exportXls of the component Filt… |
CVE-2025-10977 | Low | 3.1 | 2025-09-25 | A vulnerability was identified in JeecgBoot up to 3.8.2. Impacted is an unknown function of the file /sys/tenant/deleteBatch. The manipulation of the argument… |
CVE-2025-10976 | Low | 3.1 | 2025-09-25 | A vulnerability was determined in JeecgBoot up to 3.8.2. This issue affects some unknown processing of the file /api/getDepartUserList. Executing manipulation… |
CVE-2025-10947 | Medium | 5.3 | 2025-09-25 | A flaw has been found in Sistemas Pleno Gestão de Locação up to 2025.7.x. The impacted element is an unknown function of the file /api/areacliente/pessoa/valid… |
CVE-2025-59305 | High | 7.6 | 2025-09-24 | Improper authorization in the background migration endpoints of Langfuse 3.1 before d67b317 allows any authenticated user to invoke migration control functions… |
CVE-2025-10822 | Medium | 4.3 | 2025-09-23 | A vulnerability has been found in fuyang_lipengjun platform 1.0. The impacted element is the function SysSmsLogController of the file /sys/smslog/queryAll. Suc… |
CVE-2025-10821 | Medium | 4.3 | 2025-09-22 | A flaw has been found in fuyang_lipengjun platform 1.0. The affected element is the function TopicCategoryController of the file /topiccategory/queryAll. This… |
CVE-2025-10820 | Medium | 4.3 | 2025-09-22 | A vulnerability was detected in fuyang_lipengjun platform 1.0. Impacted is the function TopicController of the file /topic/queryAll. The manipulation results i… |
CVE-2025-10819 | Medium | 4.3 | 2025-09-22 | A security vulnerability has been detected in fuyang_lipengjun platform 1.0. This issue affects the function UserCouponController of the file /usercoupon/query… |
CVE-2025-57438 | Medium | 6.8 | 2025-09-22 | The 2wcom IP-4c 2.15.5 device suffers from a Broken Access Control vulnerability. Certain sensitive endpoints are intended to be accessible only after the admi… |
CVE-2025-10759 | Medium | 5.3 | 2025-09-21 | A vulnerability was detected in Webkul QloApps up to 1.7.0. This affects an unknown function of the component CSRF Token Handler. Performing manipulation of th… |
CVE-2025-8532 | Medium | 6.4 | 2025-09-19 | Authorization Bypass Through User-Controlled Key, Improper Authorization vulnerability in Bimser Solution Software Trade Inc. EBA Document and Workflow Managem… |
CVE-2025-10707 | Medium | 6.3 | 2025-09-19 | A weakness has been identified in JeecgBoot up to 3.8.2. Affected is an unknown function of the file /message/sysMessageTemplate/sendMsg. Executing manipulatio… |
CVE-2025-10676 | Medium | 4.3 | 2025-09-18 | A weakness has been identified in fuyang_lipengjun platform 1.0. Affected is the function BrandController of the file /brand/queryAll. Executing manipulation c… |
CVE-2025-10675 | Medium | 4.3 | 2025-09-18 | A security flaw has been discovered in fuyang_lipengjun platform 1.0. This impacts the function AttributeController of the file /attribute/queryAll. Performing… |
CVE-2025-10674 | Medium | 4.3 | 2025-09-18 | A vulnerability was identified in fuyang_lipengjun platform 1.0. This affects the function AttributeCategoryController of the file /attributecategory/queryAll… |
CVE-2025-8057 | Medium | 6.5 | 2025-09-16 | Authorization Bypass Through User-Controlled Key, Externally Controlled Reference to a Resource in Another Sphere, Improper Authorization vulnerability in Pati… |
CVE-2025-41249 | High | 7.5 | 2025-09-16 | The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type wi… |
CVE-2025-43231 | Medium | 5.5 | 2025-09-15 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.8. An app may be able to access user-sensitive data. |
CVE-2025-31255 | Critical | 9.8 | 2025-09-15 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS… |
CVE-2025-10422 | Medium | 4.3 | 2025-09-15 | A vulnerability has been found in newbee-mall up to 613a662adf1da7623ec34459bc83e3c1b12d8ce7. This issue affects the function paySuccess of the file /paySucces… |
CVE-2025-10390 | Medium | 5.4 | 2025-09-14 | A weakness has been identified in CRMEB up to 5.6.1. The affected element is the function editAddress of the file app/services/user/UserAddressServices.php. Ex… |
CVE-2025-10389 | Medium | 5.4 | 2025-09-14 | A security flaw has been discovered in CRMEB up to 5.6.1. Impacted is the function Save of the file app/services/system/admin/SystemAdminServices.php of the co… |
CVE-2025-10384 | Medium | 5.4 | 2025-09-13 | A flaw has been found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is an unknown functionality of the file /system/role/authUser/cancelAl… |
CVE-2025-10374 | High | 7.3 | 2025-09-13 | A security flaw has been discovered in Shenzhen Sixun Business Management System 7/11. This affects an unknown part of the file /Adm/OperatorStop. Performing m… |
CVE-2025-10319 | Medium | 4.3 | 2025-09-12 | A security flaw has been discovered in JeecgBoot up to 3.8.2. Affected by this issue is some unknown functionality of the file /sys/tenant/exportLog of the com… |
CVE-2025-10318 | Medium | 6.3 | 2025-09-12 | A vulnerability was identified in JeecgBoot up to 3.8.2. Affected by this vulnerability is an unknown functionality of the file /api/system/sendWebSocketMsg of… |
CVE-2025-10291 | Medium | 6.3 | 2025-09-12 | A weakness has been identified in linlinjava litemall up to 1.8.0. This affects the function WxAftersaleController of the file /wx/aftersale/cancel. Executing… |
CVE-2025-10278 | Medium | 6.3 | 2025-09-12 | A flaw has been found in YunaiV ruoyi-vue-pro up to 2025.09. Impacted is an unknown function of the file /crm/contact/transfer. This manipulation of the argume… |
CVE-2025-10277 | Medium | 6.3 | 2025-09-12 | A vulnerability was detected in YunaiV yudao-cloud up to 2025.09. This issue affects some unknown processing of the file /crm/receivable/submit. The manipulati… |
CVE-2025-10276 | Medium | 6.3 | 2025-09-12 | A security vulnerability has been detected in YunaiV ruoyi-vue-pro up to 2025.09. This vulnerability affects unknown code of the file /crm/contract/transfer. T… |
CVE-2025-10275 | Medium | 6.3 | 2025-09-12 | A weakness has been identified in YunaiV yudao-cloud up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Executing manipulation of… |
CVE-2025-6088 | Low | 3.1 | 2025-09-11 | In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conver… |
CVE-2025-10209 | Medium | 5.4 | 2025-09-10 | A security flaw has been discovered in Papermerge DMS up to 3.5.3. This issue affects some unknown processing of the component Authorization Token Handler. Per… |
CVE-2025-10086 | Medium | 6.3 | 2025-09-08 | A weakness has been identified in fuyang_lipengjun platform 1.0.0. This issue affects the function queryAll of the file /adposition/queryAll of the component A… |
CVE-2025-10084 | Medium | 4.3 | 2025-09-08 | A vulnerability was identified in elunez eladmin up to 2.7. This affects the function queryErrorLogDetail of the file /api/logs/error/1 of the component SysLog… |
CVE-2025-10073 | Medium | 4.3 | 2025-09-08 | A vulnerability was determined in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Api/turma. Executing manipulation can lea… |
CVE-2025-10014 | Low | 3.1 | 2025-09-05 | A flaw has been found in elunez eladmin up to 2.7. This impacts the function updateUserEmail of the file /api/users/updateEmail/ of the component Email Address… |
CVE-2025-26430 | High | 7.8 | 2025-09-04 | In getDestinationForApp of SpaAppBridgeActivity, there is a possible cross-user file reveal due to a logic error in the code. This could lead to local escalati… |
CVE-2025-9937 | Medium | 5.4 | 2025-09-04 | A security flaw has been discovered in elunez eladmin 1.1. Impacted is the function deleteFile of the component LocalStorageController. The manipulation result… |
CVE-2025-9936 | Medium | 4.3 | 2025-09-04 | A vulnerability was identified in fuyang_lipengjun platform 1.0.0. This issue affects the function AdController of the file /ad/queryAll. The manipulation lead… |
CVE-2025-9836 | Medium | 4.3 | 2025-09-02 | A vulnerability was found in macrozheng mall up to 1.0.3. This vulnerability affects the function paySuccess of the file /order/paySuccess. The manipulation of… |
CVE-2025-9835 | Medium | 4.3 | 2025-09-02 | A vulnerability has been found in macrozheng mall up to 1.0.3. This affects the function cancelOrder of the file /order/cancelUserOrder. The manipulation of th… |
CVE-2025-9760 | Medium | 6.3 | 2025-09-01 | A weakness has been identified in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/Api/matricula of the component Matricula API… |
CVE-2025-9687 | Medium | 6.3 | 2025-08-30 | A weakness has been identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/HistoricoEscolar/processamentoApi. Execut… |
CVE-2025-58156 | Low | 1.9 | 2025-08-29 | Centurion ERP is an ERP with a focus on ITSM and automation. In versions starting from 1.12.0 to before 1.21.0, an authenticated user can view all authenticati… |
CVE-2025-8147 | Medium | 4.3 | 2025-08-29 | The LWSCache plugin for WordPress is vulnerable to unauthorized modification of data due to improper authorization on the lwscache_activatePlugin() function in… |
CVE-2025-9609 | Medium | 6.3 | 2025-08-29 | A vulnerability was found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /educacenso/consulta. The manipulation results… |
CVE-2025-9602 | Medium | 6.3 | 2025-08-29 | A vulnerability was found in Xinhu RockOA up to 2.6.9. Impacted is the function publicsaveAjax of the file /index.php. Performing manipulation results in impro… |
CVE-2025-53795 | Critical | 9.1 | 2025-08-21 | Improper authorization in Microsoft PC Manager allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-7221 | Medium | 4.3 | 2025-08-21 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2025-9151 | Medium | 6.3 | 2025-08-19 | A security flaw has been discovered in LiuYuYang01 ThriveX-Blog up to 3.1.7. Affected by this vulnerability is the function updateJsonValueByName of the file /… |
CVE-2025-7778 | Critical | 9.8 | 2025-08-15 | The Icons Factory plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient authorization and improper path validation within the delet… |
CVE-2025-55675 | Medium | 6.5 | 2025-08-14 | Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to disco… |
CVE-2025-8840 | Medium | 5.4 | 2025-08-11 | A vulnerability was determined in jshERP up to 3.5. Affected is an unknown function of the file /jshERP-boot/user/deleteBatch of the component Endpoint. The ma… |
CVE-2025-8839 | Medium | 6.3 | 2025-08-11 | A vulnerability was found in jshERP up to 3.5. This issue affects some unknown processing of the file /jshERP-boot/user/addUser of the component Endpoint. The… |
CVE-2025-8794 | Medium | 5.3 | 2025-08-10 | A vulnerability, which was classified as problematic, has been found in LitmusChaos Litmus up to 3.19.0. Affected by this issue is some unknown functionality o… |
CVE-2025-8791 | Medium | 6.3 | 2025-08-10 | A vulnerability was found in LitmusChaos Litmus up to 3.19.0. It has been rated as critical. This issue affects some unknown processing of the file /auth/list_… |
CVE-2025-8790 | Medium | 4.3 | 2025-08-10 | A vulnerability was found in Portabilis i-Educar up to 2.9.0. It has been declared as critical. This vulnerability affects unknown code of the file /module/Api… |
CVE-2025-8789 | Medium | 4.3 | 2025-08-10 | A vulnerability was found in Portabilis i-Educar up to 2.9.0. It has been classified as problematic. This affects an unknown part of the file /module/Api/Diari… |
CVE-2025-8756 | Medium | 6.3 | 2025-08-09 | A vulnerability has been found in TDuckCloud tduck-platform up to 5.1 and classified as critical. Affected by this vulnerability is the function preHandle of t… |
CVE-2025-8755 | Medium | 5.3 | 2025-08-09 | A vulnerability was found in macrozheng mall up to 1.0.3 and classified as problematic. This issue affects the function detail of the file UmsMemberController… |
CVE-2025-54787 | Low | 3.7 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a vulnerability in SuiteCRM version 7.14.6 w… |
CVE-2025-53792 | Critical | 9.1 | 2025-08-07 | Azure Portal Elevation of Privilege Vulnerability |
CVE-2025-8547 | Medium | 5.3 | 2025-08-05 | A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as critical. This vulnerability affects unknown code of the component Email Verificati… |
CVE-2025-54868 | High | 7.5 | 2025-08-05 | LibreChat is a ChatGPT clone with additional features. In versions 0.0.6 through 0.7.7-rc1, an exposed testing endpoint allows reading arbitrary chats directly… |
CVE-2025-54130 | High | 7.5 | 2025-08-05 | Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions less than 1.3.9. If the file… |
CVE-2025-8401 | Medium | 4.3 | 2025-07-31 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.1 vi… |
CVE-2025-54585 | Medium | 6.5 | 2025-07-30 | GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can exploit the way GitProxy handl… |
CVE-2025-53944 | High | 7.7 | 2025-07-30 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents. In v0.6.15 and below, the external API's get_g… |
CVE-2025-8261 | High | 7.3 | 2025-07-28 | A weakness has been identified in Vaelsys VaelsysV4 4.1.0. This vulnerability affects unknown code of the file /grid/vgrid_server.php of the component User Cre… |
CVE-2025-54378 | High | 8.3 | 2025-07-26 | HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below… |
CVE-2025-7947 | Medium | 5.4 | 2025-07-22 | A vulnerability classified as critical has been found in jshERP up to 3.5. Affected is an unknown function of the file /user/delete of the component Account Ha… |
CVE-2025-7938 | Medium | 4.3 | 2025-07-21 | A vulnerability was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 1.0 and classified as critical. This issue affects the function updateGoods of the file GoodsC… |
CVE-2025-49746 | Critical | 9.9 | 2025-07-18 | Improper authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network. |
CVE-2025-46732 | Medium | 5.4 | 2025-07-18 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.6.6, an IDOR vulnerability in the GrapQ… |
CVE-2025-50073 | Medium | 6.1 | 2025-07-15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.2.1.4… |
CVE-2024-26291 | | 2025-07-14 | An Unauthenticated Arbitrary File Read vulnerability affects the Agent when installed on a system. The parameter filename does not validate the path thus allow… | |
CVE-2025-53709 | Medium | 5.4 | 2025-07-10 | Secure-upload is a data submission service that validates single-use tokens when accepting submissions to channels. The service only installed on a small numbe… |
CVE-2025-0928 | High | 8.8 | 2025-07-08 | In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent binaries to any model or to the controller… |
CVE-2025-53512 | Medium | 6.5 | 2025-07-08 | The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitiv… |
CVE-2025-49701 | High | 8.8 | 2025-07-08 | Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2025-53532 | Medium | 5.3 | 2025-07-07 | giscus is a commenting system powered by GitHub Discussions. A bug in giscus' discussions creation API allowed an unauthorized user to create discussions on an… |
CVE-2025-6713 | High | 7.7 | 2025-07-07 | An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCu… |
CVE-2025-53106 | High | 8.8 | 2025-07-02 | Graylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-rc.2, Graylog users can gain elevated p… |
CVE-2025-4654 | Low | 3.7 | 2025-07-02 | The Soumettre.fr plugin for WordPress is vulnerable to unauthorized access and modification of data due to a improper authorization checks on the make_signatur… |
CVE-2025-6736 | Medium | 6.3 | 2025-06-27 | A vulnerability classified as critical was found in juzaweb CMS 3.4.2. Affected by this vulnerability is an unknown functionality of the file /admin-cp/theme/i… |
CVE-2025-6735 | Medium | 6.3 | 2025-06-27 | A vulnerability classified as critical has been found in juzaweb CMS 3.4.2. Affected is an unknown function of the file /admin-cp/imports of the component Impo… |
CVE-2025-6702 | Medium | 4.3 | 2025-06-26 | A vulnerability, which was classified as problematic, was found in linlinjava litemall 1.8.0. Affected is an unknown function of the file /wx/comment/post. The… |
CVE-2025-20264 | Medium | 6.4 | 2025-06-25 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass the autho… |
CVE-2025-6431 | Medium | 6.5 | 2025-06-24 | When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker could have bypassed th… |
CVE-2025-6525 | Medium | 4.3 | 2025-06-23 | A vulnerability classified as problematic was found in 70mai 1S up to 20250611. This vulnerability affects unknown code of the file /cgi-bin/Config.cgi?action=… |
CVE-2025-6329 | Medium | 5.4 | 2025-06-20 | A vulnerability was found in ScriptAndTools Real Estate Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the… |
CVE-2025-6099 | Medium | 5.3 | 2025-06-16 | A vulnerability was found in szluyu99 gin-vue-blog up to 61dd11ccd296e8642a318ada3ef7b3f7776d2410. It has been declared as critical. This vulnerability affects… |
CVE-2025-22239 | High | 8.1 | 2025-06-13 | Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's e… |
CVE-2025-46840 | High | 8.7 | 2025-06-10 | Adobe Experience Manager versions 6.5.22 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. A low p… |
CVE-2024-43706 | High | 7.6 | 2025-06-10 | Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint. |
CVE-2025-43585 | High | 8.2 | 2025-06-10 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Authorization vulnerability that could result… |