CWE-285 · Improper Authorization (page 8)
Page 8 of 17 — CVEs classified under CWE-285, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13576 | Medium | 6.3 | 2025-11-24 | A vulnerability was detected in code-projects Blog Site 1.0. The affected element is an unknown function of the file /admin.php. Performing manipulation result… |
CVE-2025-65107 | Medium | 6.5 | 2025-11-21 | Langfuse is an open source large language model engineering platform. In versions from 2.95.0 to before 2.95.12 and from 3.17.0 to before 3.131.0, in SSO provi… |
CVE-2025-11815 | Medium | 4.3 | 2025-11-21 | The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missin… |
CVE-2025-64751 | High | 8.8 | 2025-11-21 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.4.0 to v1.11.0 ( op… |
CVE-2025-64655 | High | 8.8 | 2025-11-20 | Improper authorization in Dynamics OmniChannel SDK Storage Containers allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-65094 | High | 8.8 | 2025-11-19 | WBCE CMS is a content management system. Prior to version 1.6.4, a low-privileged user in WBCE CMS can escalate their privileges to the Administrators group by… |
CVE-2025-65033 | High | 8.1 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the poll management feature allows any authenticat… |
CVE-2025-65031 | Medium | 6.5 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization flaw in the comment creation endpoint allows auth… |
CVE-2025-65030 | High | 7.1 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the comment deletion API allows any authenticated… |
CVE-2025-65029 | High | 8.1 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authent… |
CVE-2025-65028 | Medium | 6.5 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authent… |
CVE-2025-65021 | Critical | 9.1 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability exists in the poll… |
CVE-2025-65020 | Medium | 6.5 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability in the poll duplic… |
CVE-2025-63218 | Critical | 9.8 | 2025-11-19 | The Axel Technology WOLF1MS and WOLF2MS devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the… |
CVE-2025-13085 | Medium | 4.3 | 2025-11-19 | The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Improper Authorization leading to Sensitive Post Meta Disclosure in versions up to and inclu… |
CVE-2025-12814 | Medium | 5.3 | 2025-11-19 | The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to unauthorized modification of data due to n incorrect capability check on the siteseo_reset_s… |
CVE-2025-12777 | Medium | 5.3 | 2025-11-19 | The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.10.0. This is due to the plugi… |
CVE-2025-12494 | Medium | 4.3 | 2025-11-15 | The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the aj… |
CVE-2025-13118 | Medium | 6.3 | 2025-11-13 | A vulnerability was detected in macrozheng mall-swarm up to 1.0.3. Affected by this issue is the function paySuccess of the file /order/paySuccess. The manipul… |
CVE-2025-13117 | Medium | 5.4 | 2025-11-13 | A security vulnerability has been detected in macrozheng mall-swarm and mall up to 1.0.3. Affected by this vulnerability is the function cancelOrder of the fil… |
CVE-2025-13116 | Medium | 5.4 | 2025-11-13 | A weakness has been identified in macrozheng mall-swarm and mall up to 1.0.3. Affected is the function cancelUserOrder of the file /order/cancelUserOrder. Exec… |
CVE-2025-13115 | Medium | 4.3 | 2025-11-13 | A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. This impacts the function detail of the file /order/detail/ of the component… |
CVE-2025-13114 | Medium | 6.3 | 2025-11-13 | A vulnerability was identified in macrozheng mall-swarm up to 1.0.3. This affects the function updateAttr of the file /cart/update/attr. Such manipulation lead… |
CVE-2025-64523 | High | 8.8 | 2025-11-12 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Versions pri… |
CVE-2025-11521 | High | 8.1 | 2025-11-11 | The Astra Security Suite – Firewall & Malware Scan plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient validation of remote URLs f… |
CVE-2025-12435 | Medium | 5.4 | 2025-11-10 | Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-63691 | Critical | 9.6 | 2025-11-07 | In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the token query interface (/api/admin/sys-… |
CVE-2025-12854 | Low | 3.7 | 2025-11-07 | A vulnerability was identified in newbee-mall-plus up to 2.4.1. This vulnerability affects the function executeSeckill of the file /seckillExecution/. The mani… |
CVE-2025-4519 | High | 8.8 | 2025-11-07 | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check… |
CVE-2025-12360 | Medium | 4.3 | 2025-11-06 | The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to unauthorized API usage due to a missing capability check on the rtaf… |
CVE-2025-60784 | Medium | 6.5 | 2025-11-05 | A vulnerability in the XiaozhangBang Voluntary Like System V8.8 allows remote attackers to manipulate the zhekou parameter in the /topfirst.php Pay module, ena… |
CVE-2025-62520 | Medium | 4.3 | 2025-11-04 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, due to insufficient access-level checks, any non-admin user with a… |
CVE-2025-12623 | Low | 3.1 | 2025-11-03 | A vulnerability was identified in fushengqian fuint up to 41e26be8a2c609413a0feaa69bdad33a71ae8032. Affected by this issue is some unknown functionality of the… |
CVE-2025-12367 | Medium | 4.3 | 2025-11-01 | The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.3.1. This is due to the plugin not… |
CVE-2025-11174 | Medium | 5.3 | 2025-11-01 | The Document Library Lite plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 1.1.6. This is due to the plugin e… |
CVE-2025-12304 | Medium | 4.3 | 2025-10-27 | A vulnerability has been found in dulaiduwang003 TIME-SEA-PLUS up to fb299162f18498dd9cf17da906886d80a077d53b. This affects the function alipayIsSucceed of the… |
CVE-2025-12288 | Medium | 4.3 | 2025-10-27 | A vulnerability was detected in Bdtask Pharmacy Management System up to 9.4. Affected is an unknown function of the file /user/edit_user/ of the component User… |
CVE-2025-12283 | Medium | 4.3 | 2025-10-27 | A security flaw has been discovered in code-projects Client Details System 1.0. The impacted element is an unknown function. The manipulation results in author… |
CVE-2025-6639 | Medium | 5.4 | 2025-10-25 | The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and incl… |
CVE-2025-12005 | Medium | 4.3 | 2025-10-25 | The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, a… |
CVE-2025-11879 | Medium | 6.5 | 2025-10-25 | The GenerateBlocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_option_rest' function in all… |
CVE-2025-11244 | Low | 3.7 | 2025-10-25 | The Password Protected plugin for WordPress is vulnerable to authorization bypass via IP address spoofing in all versions up to, and including, 2.7.11. This is… |
CVE-2025-10902 | Medium | 4.3 | 2025-10-24 | The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ai_scan_result_remove'… |
CVE-2025-62401 | Medium | 5.4 | 2025-10-23 | An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an as… |
CVE-2025-62610 | High | 8.1 | 2025-10-22 | Hono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4.10.2, Hono’s JWT Auth Middleware does… |
CVE-2025-22177 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-22176 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-22175 | Medium | 5.4 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-22174 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-22173 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-22172 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-22171 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user is able to alter the private checklists of other users. |
CVE-2025-22170 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user without sufficient privileges to perform an action could if they included a particular… |
CVE-2025-22169 | Medium | 5.4 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-22168 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-53056 | Medium | 6.1 | 2025-10-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Object and Environment Tech). Supported versions that are affecte… |
CVE-2025-11256 | Medium | 5.3 | 2025-10-18 | The Kognetiks Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all ver… |
CVE-2025-11510 | Medium | 4.3 | 2025-10-18 | The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabili… |
CVE-2025-54822 | Medium | 4.3 | 2025-10-14 | An improper authorization vulnerability [CWE-285] vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.8, FortiOS 7.0.0 through 7.0… |
CVE-2025-61928 | | 2025-10-09 | Better Auth is an authentication and authorization library for TypeScript. In versions prior to 1.3.26, unauthenticated attackers can create or modify API keys… | |
CVE-2025-59271 | High | 8.7 | 2025-10-09 | Redis Enterprise Elevation of Privilege Vulnerability |
CVE-2025-61524 | High | 7.2 | 2025-10-08 | An issue in the permission verification module and organization/application editing interface in Casdoor v2.26.0 and before, and fixed in v.2.63.0, allows remo… |
CVE-2025-49594 | | 2025-10-06 | XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to… | |
CVE-2025-11321 | Medium | 4.3 | 2025-10-06 | A vulnerability was detected in zhuimengshaonian wisdom-education up to 1.0.4. The affected element is an unknown function of the file src/main/java/com/educat… |
CVE-2025-11272 | Medium | 5.4 | 2025-10-04 | A vulnerability has been found in SeriaWei ZKEACMS up to 4.3. This affects the function Delete of the file src/ZKEACMS.Redirection/Controllers/UrlRedirectionCo… |
CVE-2025-11227 | Medium | 6.5 | 2025-10-04 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 v… |
CVE-2025-59686 | Medium | 6.5 | 2025-10-01 | Kazaar 1.25.12 allows /api/v1/org-id/orders/order-id/documents calls with a modified order-id. |
CVE-2025-11080 | Medium | 4.3 | 2025-09-27 | A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4. This vulnerability affects the function selectStudentExamInfoList… |
CVE-2025-11050 | Medium | 6.3 | 2025-09-27 | A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /periodo-lancamento. Executing manipulation can lead to impro… |
CVE-2025-11049 | Medium | 6.3 | 2025-09-27 | A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /unificacao-aluno. Performing… |
CVE-2025-11048 | Medium | 6.3 | 2025-09-26 | A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /consulta-… |
CVE-2025-11047 | Medium | 6.3 | 2025-09-26 | A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file /module/Api/aluno. This manipulation of the argum… |
CVE-2025-11030 | High | 7.3 | 2025-09-26 | A vulnerability was detected in Tutorials-Website Employee Management System up to 611887d8f8375271ce8abc704507d46340837a60. Impacted is an unknown function of… |
CVE-2025-10992 | Medium | 5.3 | 2025-09-26 | A vulnerability was determined in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. Affected is an unknown function of the file /user/info/look… |
CVE-2025-10989 | Medium | 6.3 | 2025-09-26 | A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This vulnerability affects unknown code of the file /system/role/authUser/selectAll. Pe… |
CVE-2025-10988 | Medium | 6.3 | 2025-09-26 | A vulnerability was identified in YunaiV ruoyi-vue-pro up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Such manipulation leads… |
CVE-2025-10987 | Medium | 6.3 | 2025-09-26 | A vulnerability was determined in YunaiV yudao-cloud up to 2025.09. Affected by this issue is some unknown functionality of the file /crm/contact/transfer of t… |
CVE-2025-10981 | Medium | 4.3 | 2025-09-26 | A vulnerability was detected in JeecgBoot up to 3.8.2. This impacts an unknown function of the file /sys/tenant/exportXls. Performing manipulation results in i… |
CVE-2025-10980 | Medium | 4.3 | 2025-09-26 | A security vulnerability has been detected in JeecgBoot up to 3.8.2. This affects an unknown function of the file /sys/position/exportXls. Such manipulation le… |
CVE-2025-10979 | Medium | 4.3 | 2025-09-25 | A weakness has been identified in JeecgBoot up to 3.8.2. The impacted element is an unknown function of the file /sys/role/exportXls. This manipulation causes… |
CVE-2025-10978 | Medium | 4.3 | 2025-09-25 | A security flaw has been discovered in JeecgBoot up to 3.8.2. The affected element is an unknown function of the file /sys/user/exportXls of the component Filt… |
CVE-2025-10977 | Low | 3.1 | 2025-09-25 | A vulnerability was identified in JeecgBoot up to 3.8.2. Impacted is an unknown function of the file /sys/tenant/deleteBatch. The manipulation of the argument… |
CVE-2025-10976 | Low | 3.1 | 2025-09-25 | A vulnerability was determined in JeecgBoot up to 3.8.2. This issue affects some unknown processing of the file /api/getDepartUserList. Executing manipulation… |
CVE-2025-10947 | Medium | 5.3 | 2025-09-25 | A flaw has been found in Sistemas Pleno Gestão de Locação up to 2025.7.x. The impacted element is an unknown function of the file /api/areacliente/pessoa/valid… |
CVE-2025-59305 | High | 7.6 | 2025-09-24 | Improper authorization in the background migration endpoints of Langfuse 3.1 before d67b317 allows any authenticated user to invoke migration control functions… |
CVE-2025-10822 | Medium | 4.3 | 2025-09-23 | A vulnerability has been found in fuyang_lipengjun platform 1.0. The impacted element is the function SysSmsLogController of the file /sys/smslog/queryAll. Suc… |
CVE-2025-10821 | Medium | 4.3 | 2025-09-22 | A flaw has been found in fuyang_lipengjun platform 1.0. The affected element is the function TopicCategoryController of the file /topiccategory/queryAll. This… |
CVE-2025-10820 | Medium | 4.3 | 2025-09-22 | A vulnerability was detected in fuyang_lipengjun platform 1.0. Impacted is the function TopicController of the file /topic/queryAll. The manipulation results i… |
CVE-2025-10819 | Medium | 4.3 | 2025-09-22 | A security vulnerability has been detected in fuyang_lipengjun platform 1.0. This issue affects the function UserCouponController of the file /usercoupon/query… |
CVE-2025-57438 | Medium | 6.8 | 2025-09-22 | The 2wcom IP-4c 2.15.5 device suffers from a Broken Access Control vulnerability. Certain sensitive endpoints are intended to be accessible only after the admi… |
CVE-2025-10759 | Medium | 5.3 | 2025-09-21 | A vulnerability was detected in Webkul QloApps up to 1.7.0. This affects an unknown function of the component CSRF Token Handler. Performing manipulation of th… |
CVE-2025-8532 | Medium | 6.4 | 2025-09-19 | Authorization Bypass Through User-Controlled Key, Improper Authorization vulnerability in Bimser Solution Software Trade Inc. EBA Document and Workflow Managem… |
CVE-2025-10707 | Medium | 6.3 | 2025-09-19 | A weakness has been identified in JeecgBoot up to 3.8.2. Affected is an unknown function of the file /message/sysMessageTemplate/sendMsg. Executing manipulatio… |
CVE-2025-10676 | Medium | 4.3 | 2025-09-18 | A weakness has been identified in fuyang_lipengjun platform 1.0. Affected is the function BrandController of the file /brand/queryAll. Executing manipulation c… |
CVE-2025-10675 | Medium | 4.3 | 2025-09-18 | A security flaw has been discovered in fuyang_lipengjun platform 1.0. This impacts the function AttributeController of the file /attribute/queryAll. Performing… |
CVE-2025-10674 | Medium | 4.3 | 2025-09-18 | A vulnerability was identified in fuyang_lipengjun platform 1.0. This affects the function AttributeCategoryController of the file /attributecategory/queryAll… |
CVE-2025-8057 | Medium | 6.5 | 2025-09-16 | Authorization Bypass Through User-Controlled Key, Externally Controlled Reference to a Resource in Another Sphere, Improper Authorization vulnerability in Pati… |
CVE-2025-41249 | High | 7.5 | 2025-09-16 | The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type wi… |
CVE-2025-43231 | Medium | 5.5 | 2025-09-15 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.8. An app may be able to access user-sensitive data. |
CVE-2025-31255 | Critical | 9.8 | 2025-09-15 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS… |