CWE-285 · Improper Authorization (page 8)
Page 8 of 16 — CVEs classified under CWE-285, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-5522 | High | 7.3 | 2025-06-03 | A vulnerability was found in jack0240 魏 bskms 蓝天幼儿园管理系统 up to dffe6640b5b54d8e29da6f060e0493fea74b3fad. It has been rated as critical. Affected by this issue i… |
CVE-2025-5511 | Medium | 5.3 | 2025-06-03 | A vulnerability, which was classified as critical, has been found in quequnlong shiyi-blog up to 1.2.1. This issue affects some unknown processing of the file… |
CVE-2025-3454 | Medium | 5.0 | 2025-06-02 | This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with… |
CVE-2025-4672 | High | 8.8 | 2025-05-31 | The Offsprout Page Builder plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization placed on the permission_callback() functio… |
CVE-2025-4631 | Critical | 9.8 | 2025-05-31 | The Profitori plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the stocktend_object endpoint in versions 2.0.6.0… |
CVE-2025-4103 | High | 8.8 | 2025-05-31 | The WP-GeoMeta plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wp_ajax_wpgm_start_geojson_import() function… |
CVE-2025-5182 | Medium | 4.3 | 2025-05-26 | A vulnerability has been found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1 and classified as critical. This vulnerability affects unk… |
CVE-2025-5175 | Medium | 5.3 | 2025-05-26 | A vulnerability was found in erdogant pypickle up to 1.1.5. It has been classified as critical. This affects the function Save of the file pypickle/pypickle.py… |
CVE-2025-48371 | High | 8.8 | 2025-05-22 | OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 (corresponding to Helm chart openfga-0.2.16 through openfga-0.2.30 and doc… |
CVE-2025-48063 | High | 8.8 | 2025-05-21 | XWiki is a generic wiki platform. In XWiki 16.10.0, required rights were introduced as a way to limit which rights a document can have. Part of the security mo… |
CVE-2025-4819 | Low | 3.1 | 2025-05-17 | A vulnerability classified as problematic has been found in y_project RuoYi 4.8.0. Affected is an unknown function of the file /monitor/online/batchForceLogout… |
CVE-2025-4474 | High | 8.8 | 2025-05-13 | The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fed_admin_setting_form_function() fu… |
CVE-2025-4473 | High | 8.8 | 2025-05-13 | The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_request() function in versions… |
CVE-2025-31249 | High | 7.1 | 2025-05-12 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive user data. |
CVE-2025-29827 | Critical | 9.9 | 2025-05-08 | Improper authorization in Azure Automation allows an authorized attacker to elevate privileges over a network. |
CVE-2025-4104 | Critical | 9.8 | 2025-05-07 | The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fed_wp_ajax_fed_login_form_post() fu… |
CVE-2025-3924 | Medium | 5.3 | 2025-05-07 | The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized access of data via its publicly exposed reset-password endpoint. The… |
CVE-2025-3921 | High | 8.2 | 2025-05-07 | The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handel… |
CVE-2025-3918 | Critical | 9.8 | 2025-05-03 | The Job Listings plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the register_action() function in versions 0.1… |
CVE-2025-4210 | High | 7.3 | 2025-05-02 | A vulnerability classified as critical was found in Casdoor up to 1.811.0. This vulnerability affects the function HandleScim of the file controllers/scim.go o… |
CVE-2025-4136 | Medium | 5.4 | 2025-04-30 | A vulnerability was found in Weitong Mall 1.0.0. It has been classified as critical. This affects an unknown part of the component Sale Endpoint. The manipulat… |
CVE-2025-30392 | Critical | 9.8 | 2025-04-30 | Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-30390 | Critical | 9.9 | 2025-04-30 | Improper authorization in Azure allows an authorized attacker to elevate privileges over a network. |
CVE-2025-30389 | High | 8.7 | 2025-04-30 | Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-32972 | Low | 2.7 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 6.1-milestone-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to befo… |
CVE-2025-4017 | Medium | 4.3 | 2025-04-28 | A vulnerability classified as problematic was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This vulnerability affects the funct… |
CVE-2025-4016 | Medium | 5.4 | 2025-04-28 | A vulnerability classified as critical has been found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This affects the function deleteIn… |
CVE-2025-3981 | Medium | 4.3 | 2025-04-27 | A vulnerability, which was classified as problematic, has been found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0. This issue affects some u… |
CVE-2025-3980 | Medium | 4.3 | 2025-04-27 | A vulnerability classified as problematic was found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0. This vulnerability affects unknown code of… |
CVE-2025-3977 | Medium | 4.3 | 2025-04-27 | A vulnerability was found in iteachyou Dreamer CMS up to 4.1.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2025-3967 | Medium | 5.4 | 2025-04-27 | A vulnerability was found in itwanger paicoding 1.0.3. It has been classified as critical. This affects an unknown part of the file /article/api/post of the co… |
CVE-2025-2850 | Low | 3.5 | 2025-04-26 | A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT180… |
CVE-2025-32982 | High | 7.5 | 2025-04-25 | NETSCOUT nGeniusONE before 6.4.0 b2350 has a Broken Authorization Schema for the report module. |
CVE-2025-32964 | Medium | 4.6 | 2025-04-22 | ManageWiki is a MediaWiki extension allowing users to manage wikis. Prior to commit 00bebea, when enabling a conflicting extension, a restricted extension woul… |
CVE-2025-29659 | Critical | 9.8 | 2025-04-21 | Yi IOT XY-3820 6.0.24.10 is vulnerable to Remote Command Execution via the "cmd_listen" function located in the "cmd" binary. |
CVE-2025-3587 | Medium | 6.3 | 2025-04-14 | A vulnerability classified as critical was found in ZeroWdd/code-projects studentmanager 1.0. This vulnerability affects unknown code of the file /getTeacherLi… |
CVE-2025-3569 | Medium | 6.3 | 2025-04-14 | A vulnerability was found in JamesZBL/code-projects db-hospital-drug 1.0 and classified as critical. Affected by this issue is some unknown functionality of th… |
CVE-2025-3567 | Medium | 4.3 | 2025-04-14 | A vulnerability, which was classified as problematic, was found in veal98 小牛肉 Echo 开源社区系统 4.2. Affected is the function preHandle of the file src/main/java/com… |
CVE-2025-3564 | Medium | 4.3 | 2025-04-14 | A vulnerability classified as problematic has been found in huanfenz/code-projects StudentManager up to 1.0. This affects an unknown part of the component Teac… |
CVE-2025-3550 | Medium | 4.3 | 2025-04-14 | A vulnerability has been found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0 and classified as problematic. Affected by this vulnerability is… |
CVE-2025-3537 | Medium | 5.3 | 2025-04-13 | A vulnerability was found in Tutorials-Website Employee Management System 1.0. It has been classified as critical. This affects an unknown part of the file /ad… |
CVE-2025-3536 | Medium | 6.5 | 2025-04-13 | A vulnerability was found in Tutorials-Website Employee Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality… |
CVE-2023-42973 | Medium | 4.0 | 2025-04-11 | Private Browsing tabs may be accessed without authentication. This issue is fixed in iOS 17 and iPadOS 17. The issue was addressed with improved UI. |
CVE-2025-29794 | High | 8.8 | 2025-04-08 | Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2025-30373 | Medium | 6.5 | 2025-04-07 | Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specif… |
CVE-2025-3202 | High | 7.3 | 2025-04-04 | A vulnerability classified as critical has been found in ageerle ruoyi-ai up to 2.0.0. Affected is an unknown function of the file ruoyi-modules/ruoyi-system/s… |
CVE-2025-3199 | High | 7.3 | 2025-04-04 | A vulnerability was found in ageerle ruoyi-ai up to 2.0.1 and classified as critical. Affected by this issue is some unknown functionality of the file ruoyi-mo… |
CVE-2025-28131 | Medium | 4.6 | 2025-04-01 | A Broken Access Control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows low-privilege users with "Read-Only" access to perform administrative action… |
CVE-2025-26683 | High | 8.1 | 2025-03-31 | Improper authorization in Azure Playwright allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-3014 | | 2025-03-31 | Insecure Direct Object References (IDOR) in access control in Tracking 2.1.4 on NightWolf Penetration Testing allows an attacker to access via manipulating req… | |
CVE-2025-3013 | | 2025-03-31 | Insecure Direct Object References (IDOR) in access control in Customer Portal before 2.1.4 on NightWolf Penetration Testing allows an attacker to access via ma… | |
CVE-2025-2600 | Medium | 6.8 | 2025-03-26 | Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the ELEVATED_PASSWORD var… |
CVE-2025-2528 | Low | 3.6 | 2025-03-26 | Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a configuration dif… |
CVE-2025-29778 | Medium | 5.8 | 2025-03-24 | Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegEx… |
CVE-2025-2653 | Medium | 4.3 | 2025-03-23 | A vulnerability was found in FoxCMS 1.25 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to imprope… |
CVE-2025-2639 | Medium | 4.3 | 2025-03-23 | A vulnerability has been found in JIZHICMS up to 1.7.0 and classified as problematic. This vulnerability affects unknown code of the file /user/release.html of… |
CVE-2025-2638 | Medium | 4.3 | 2025-03-23 | A vulnerability, which was classified as problematic, was found in JIZHICMS up to 1.7.0. This affects an unknown part of the file /user/release.html of the com… |
CVE-2025-2637 | Medium | 4.3 | 2025-03-23 | A vulnerability, which was classified as problematic, has been found in JIZHICMS up to 1.7.0. Affected by this issue is some unknown functionality of the file… |
CVE-2025-29927 | Critical | 9.1 | 2025-03-21 | Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it… |
CVE-2025-2589 | Medium | 5.5 | 2025-03-21 | A vulnerability was found in code-projects Human Resource Management System 1.0.1 and classified as critical. This issue affects the function Index of the file… |
CVE-2025-29922 | Critical | 9.6 | 2025-03-20 | kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identified vulnerability… |
CVE-2025-29926 | Critical | 9.8 | 2025-03-19 | XWiki Platform is a generic wiki platform. Prior to 15.10.15, 16.4.6, and 16.10.0, any user can exploit the WikiManager REST API to create a new wiki, where th… |
CVE-2025-30117 | High | 7.3 | 2025-03-18 | An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Managing Settings and Obtaining Sensitive Data and Sabotaging the Car Battery can be… |
CVE-2024-44314 | Medium | 6.5 | 2025-03-18 | TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthorized users to update order statuses. Th… |
CVE-2025-2397 | Low | 2.4 | 2025-03-17 | A vulnerability was found in China Mobile P22g-CIac, ZXWT-MIG-P4G4V, ZXWT-MIG-P8G8V, GT3200-4G4P and GT3200-8G8P up to 20250305. It has been declared as proble… |
CVE-2025-2360 | High | 7.3 | 2025-03-17 | A vulnerability classified as critical was found in D-Link DIR-823G 1.0.2B05_20181207. Affected by this vulnerability is the function SetUpnpSettings of the fi… |
CVE-2025-2359 | High | 7.3 | 2025-03-17 | A vulnerability classified as critical has been found in D-Link DIR-823G 1.0.2B05_20181207. Affected is the function SetDDNSSettings of the file /HNAP1/ of the… |
CVE-2025-2345 | Critical | 9.8 | 2025-03-16 | A vulnerability, which was classified as very critical, was found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. This affects an unknown part. The manipu… |
CVE-2025-2320 | High | 7.3 | 2025-03-14 | A vulnerability has been found in 274056675 springboot-openai-chatgpt e84f6f5 and classified as critical. Affected by this vulnerability is the function submit… |
CVE-2025-24053 | High | 7.2 | 2025-03-13 | Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. |
CVE-2025-27602 | Medium | 4.9 | 2025-03-11 | Umbraco is a free and open source .NET content management system. In versions of Umbraco's web backoffice program prior to versions 10.8.9 and 13.7.1, via mani… |
CVE-2025-27601 | Medium | 4.3 | 2025-03-11 | Umbraco is a free and open source .NET content management system. An improper API access control issue has been identified Umbraco's API management package pri… |
CVE-2025-2114 | Low | 3.7 | 2025-03-09 | A vulnerability, which was classified as problematic, has been found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 7. This issue a… |
CVE-2024-13552 | Medium | 4.3 | 2025-03-07 | The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and… |
CVE-2025-27509 | | 2025-03-06 | fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-formed SAML response… | |
CVE-2024-13724 | Medium | 4.3 | 2025-03-04 | The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to unauthorized ac… |
CVE-2024-43051 | Medium | 5.5 | 2025-03-03 | Information disclosure while deriving keys for a session for any Widevine use case. |
CVE-2025-1847 | Medium | 6.3 | 2025-03-03 | A vulnerability was found in zj1983 zz up to 2024-8. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to impro… |
CVE-2025-1815 | High | 7.3 | 2025-03-02 | A vulnerability, which was classified as critical, was found in pbrong hrms up to 1.0.1. This affects the function HrmsDB of the file \resource\resource.go. Th… |
CVE-2025-1806 | Medium | 4.3 | 2025-03-02 | A vulnerability, which was classified as problematic, has been found in Eastnets PaymentSafe 2.5.26.0. Affected by this issue is some unknown functionality of… |
CVE-2025-27399 | Medium | 5.3 | 2025-02-27 | Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is s… |
CVE-2024-47053 | High | 7.7 | 2025-02-26 | This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensi… |
CVE-2025-23024 | Medium | 4.3 | 2025-02-25 | GLPI is a free asset and IT management software package. Starting in version 0.72 and prior to version 10.0.18, an anonymous user can disable all the active pl… |
CVE-2025-1607 | Medium | 4.3 | 2025-02-24 | A vulnerability, which was classified as problematic, has been found in SourceCodester Best Employee Management System 1.0. This issue affects some unknown pro… |
CVE-2025-1361 | High | 7.5 | 2025-02-22 | The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure in all versions up to, and including, 2.38.8 due to missing… |
CVE-2025-25196 | Critical | 9.8 | 2025-02-19 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA < v1.8.4 (Helm chart <… |
CVE-2025-1007 | Medium | 5.3 | 2025-02-19 | In OpenVSX version v0.9.0 to v0.20.0, the /user/namespace/{namespace}/details API allows a user to edit all namespace details, even if the user is not a name… |
CVE-2024-13692 | Medium | 5.4 | 2025-02-14 | The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to… |
CVE-2025-1226 | Medium | 5.3 | 2025-02-12 | A vulnerability was found in ywoa up to 2024.07.03. It has been declared as critical. This vulnerability affects unknown code of the file /oa/setup/setup.jsp… |
CVE-2024-13821 | Medium | 5.3 | 2025-02-12 | The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Booking Manipulation in all versions up to, and including, 10.1… |
CVE-2025-24418 | High | 8.1 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Authorization vulnerability that could re… |
CVE-2025-21400 | High | 8.0 | 2025-02-11 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2025-1078 | Medium | 5.3 | 2025-02-06 | A vulnerability has been found in AppHouseKitchen AlDente Charge Limiter up to 1.29 on macOS and classified as critical. This vulnerability affects the functio… |
CVE-2024-57954 | Medium | 6.2 | 2025-02-06 | Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-20125 | Critical | 9.1 | 2025-02-05 | A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker with valid read-only credentials to obtain sensitive information, change n… |
CVE-2025-24784 | Medium | 4.3 | 2025-01-30 | kubewarden-controller is a Kubernetes controller that allows you to dynamically register Kubewarden admission policies. The policy group feature, added to by t… |
CVE-2025-24376 | Medium | 6.5 | 2025-01-30 | kubewarden-controller is a Kubernetes controller that allows you to dynamically register Kubewarden admission policies. By design, AdmissionPolicy and Admissio… |
CVE-2024-13646 | High | 8.1 | 2025-01-30 | The Single-user-chat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to insufficient validatio… |
CVE-2024-13694 | High | 7.5 | 2025-01-30 | The WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features) plugin for WordPress is vulnerable to Insecure Direct Object R… |
CVE-2025-0849 | Medium | 6.3 | 2025-01-30 | A vulnerability classified as critical has been found in CampCodes School Management Software 1.0. Affected is an unknown function of the file /edit-staff/ of… |