CWE-285 · Improper Authorization (page 9)
Page 9 of 17 — CVEs classified under CWE-285, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-10422 | Medium | 4.3 | 2025-09-15 | A vulnerability has been found in newbee-mall up to 613a662adf1da7623ec34459bc83e3c1b12d8ce7. This issue affects the function paySuccess of the file /paySucces… |
CVE-2025-10390 | Medium | 5.4 | 2025-09-14 | A weakness has been identified in CRMEB up to 5.6.1. The affected element is the function editAddress of the file app/services/user/UserAddressServices.php. Ex… |
CVE-2025-10389 | Medium | 5.4 | 2025-09-14 | A security flaw has been discovered in CRMEB up to 5.6.1. Impacted is the function Save of the file app/services/system/admin/SystemAdminServices.php of the co… |
CVE-2025-10384 | Medium | 5.4 | 2025-09-13 | A flaw has been found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is an unknown functionality of the file /system/role/authUser/cancelAl… |
CVE-2025-10374 | High | 7.3 | 2025-09-13 | A security flaw has been discovered in Shenzhen Sixun Business Management System 7/11. This affects an unknown part of the file /Adm/OperatorStop. Performing m… |
CVE-2025-10319 | Medium | 4.3 | 2025-09-12 | A security flaw has been discovered in JeecgBoot up to 3.8.2. Affected by this issue is some unknown functionality of the file /sys/tenant/exportLog of the com… |
CVE-2025-10318 | Medium | 6.3 | 2025-09-12 | A vulnerability was identified in JeecgBoot up to 3.8.2. Affected by this vulnerability is an unknown functionality of the file /api/system/sendWebSocketMsg of… |
CVE-2025-10291 | Medium | 6.3 | 2025-09-12 | A weakness has been identified in linlinjava litemall up to 1.8.0. This affects the function WxAftersaleController of the file /wx/aftersale/cancel. Executing… |
CVE-2025-10278 | Medium | 6.3 | 2025-09-12 | A flaw has been found in YunaiV ruoyi-vue-pro up to 2025.09. Impacted is an unknown function of the file /crm/contact/transfer. This manipulation of the argume… |
CVE-2025-10277 | Medium | 6.3 | 2025-09-12 | A vulnerability was detected in YunaiV yudao-cloud up to 2025.09. This issue affects some unknown processing of the file /crm/receivable/submit. The manipulati… |
CVE-2025-10276 | Medium | 6.3 | 2025-09-12 | A security vulnerability has been detected in YunaiV ruoyi-vue-pro up to 2025.09. This vulnerability affects unknown code of the file /crm/contract/transfer. T… |
CVE-2025-10275 | Medium | 6.3 | 2025-09-12 | A weakness has been identified in YunaiV yudao-cloud up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Executing manipulation of… |
CVE-2025-6088 | Low | 3.1 | 2025-09-11 | In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conver… |
CVE-2025-10209 | Medium | 5.4 | 2025-09-10 | A security flaw has been discovered in Papermerge DMS up to 3.5.3. This issue affects some unknown processing of the component Authorization Token Handler. Per… |
CVE-2025-10086 | Medium | 6.3 | 2025-09-08 | A weakness has been identified in fuyang_lipengjun platform 1.0.0. This issue affects the function queryAll of the file /adposition/queryAll of the component A… |
CVE-2025-10084 | Medium | 4.3 | 2025-09-08 | A vulnerability was identified in elunez eladmin up to 2.7. This affects the function queryErrorLogDetail of the file /api/logs/error/1 of the component SysLog… |
CVE-2025-10073 | Medium | 4.3 | 2025-09-08 | A vulnerability was determined in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Api/turma. Executing manipulation can lea… |
CVE-2025-10014 | Low | 3.1 | 2025-09-05 | A flaw has been found in elunez eladmin up to 2.7. This impacts the function updateUserEmail of the file /api/users/updateEmail/ of the component Email Address… |
CVE-2025-26430 | High | 7.8 | 2025-09-04 | In getDestinationForApp of SpaAppBridgeActivity, there is a possible cross-user file reveal due to a logic error in the code. This could lead to local escalati… |
CVE-2025-9937 | Medium | 5.4 | 2025-09-04 | A security flaw has been discovered in elunez eladmin 1.1. Impacted is the function deleteFile of the component LocalStorageController. The manipulation result… |
CVE-2025-9936 | Medium | 4.3 | 2025-09-04 | A vulnerability was identified in fuyang_lipengjun platform 1.0.0. This issue affects the function AdController of the file /ad/queryAll. The manipulation lead… |
CVE-2025-9836 | Medium | 4.3 | 2025-09-02 | A vulnerability was found in macrozheng mall up to 1.0.3. This vulnerability affects the function paySuccess of the file /order/paySuccess. The manipulation of… |
CVE-2025-9835 | Medium | 4.3 | 2025-09-02 | A vulnerability has been found in macrozheng mall up to 1.0.3. This affects the function cancelOrder of the file /order/cancelUserOrder. The manipulation of th… |
CVE-2025-9760 | Medium | 6.3 | 2025-09-01 | A weakness has been identified in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/Api/matricula of the component Matricula API… |
CVE-2025-9687 | Medium | 6.3 | 2025-08-30 | A weakness has been identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/HistoricoEscolar/processamentoApi. Execut… |
CVE-2025-58156 | Low | 1.9 | 2025-08-29 | Centurion ERP is an ERP with a focus on ITSM and automation. In versions starting from 1.12.0 to before 1.21.0, an authenticated user can view all authenticati… |
CVE-2025-8147 | Medium | 4.3 | 2025-08-29 | The LWSCache plugin for WordPress is vulnerable to unauthorized modification of data due to improper authorization on the lwscache_activatePlugin() function in… |
CVE-2025-9609 | Medium | 6.3 | 2025-08-29 | A vulnerability was found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /educacenso/consulta. The manipulation results… |
CVE-2025-9602 | Medium | 6.3 | 2025-08-29 | A vulnerability was found in Xinhu RockOA up to 2.6.9. Impacted is the function publicsaveAjax of the file /index.php. Performing manipulation results in impro… |
CVE-2025-53795 | Critical | 9.1 | 2025-08-21 | Improper authorization in Microsoft PC Manager allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-7221 | Medium | 4.3 | 2025-08-21 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2025-9151 | Medium | 6.3 | 2025-08-19 | A security flaw has been discovered in LiuYuYang01 ThriveX-Blog up to 3.1.7. Affected by this vulnerability is the function updateJsonValueByName of the file /… |
CVE-2025-7778 | Critical | 9.8 | 2025-08-15 | The Icons Factory plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient authorization and improper path validation within the delet… |
CVE-2025-55675 | Medium | 6.5 | 2025-08-14 | Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to disco… |
CVE-2025-8840 | Medium | 5.4 | 2025-08-11 | A vulnerability was determined in jshERP up to 3.5. Affected is an unknown function of the file /jshERP-boot/user/deleteBatch of the component Endpoint. The ma… |
CVE-2025-8839 | Medium | 6.3 | 2025-08-11 | A vulnerability was found in jshERP up to 3.5. This issue affects some unknown processing of the file /jshERP-boot/user/addUser of the component Endpoint. The… |
CVE-2025-8794 | Medium | 5.3 | 2025-08-10 | A vulnerability, which was classified as problematic, has been found in LitmusChaos Litmus up to 3.19.0. Affected by this issue is some unknown functionality o… |
CVE-2025-8791 | Medium | 6.3 | 2025-08-10 | A vulnerability was found in LitmusChaos Litmus up to 3.19.0. It has been rated as critical. This issue affects some unknown processing of the file /auth/list_… |
CVE-2025-8790 | Medium | 4.3 | 2025-08-10 | A vulnerability was found in Portabilis i-Educar up to 2.9.0. It has been declared as critical. This vulnerability affects unknown code of the file /module/Api… |
CVE-2025-8789 | Medium | 4.3 | 2025-08-10 | A vulnerability was found in Portabilis i-Educar up to 2.9.0. It has been classified as problematic. This affects an unknown part of the file /module/Api/Diari… |
CVE-2025-8756 | Medium | 6.3 | 2025-08-09 | A vulnerability has been found in TDuckCloud tduck-platform up to 5.1 and classified as critical. Affected by this vulnerability is the function preHandle of t… |
CVE-2025-8755 | Medium | 5.3 | 2025-08-09 | A vulnerability was found in macrozheng mall up to 1.0.3 and classified as problematic. This issue affects the function detail of the file UmsMemberController… |
CVE-2025-54787 | Low | 3.7 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a vulnerability in SuiteCRM version 7.14.6 w… |
CVE-2025-53792 | Critical | 9.1 | 2025-08-07 | Azure Portal Elevation of Privilege Vulnerability |
CVE-2025-8547 | Medium | 5.3 | 2025-08-05 | A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as critical. This vulnerability affects unknown code of the component Email Verificati… |
CVE-2025-54868 | High | 7.5 | 2025-08-05 | LibreChat is a ChatGPT clone with additional features. In versions 0.0.6 through 0.7.7-rc1, an exposed testing endpoint allows reading arbitrary chats directly… |
CVE-2025-54130 | High | 7.5 | 2025-08-05 | Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions less than 1.3.9. If the file… |
CVE-2025-8401 | Medium | 4.3 | 2025-07-31 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.1 vi… |
CVE-2025-54585 | Medium | 6.5 | 2025-07-30 | GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can exploit the way GitProxy handl… |
CVE-2025-53944 | High | 7.7 | 2025-07-30 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents. In v0.6.15 and below, the external API's get_g… |
CVE-2025-8261 | High | 7.3 | 2025-07-28 | A weakness has been identified in Vaelsys VaelsysV4 4.1.0. This vulnerability affects unknown code of the file /grid/vgrid_server.php of the component User Cre… |
CVE-2025-54378 | High | 8.3 | 2025-07-26 | HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below… |
CVE-2025-7947 | Medium | 5.4 | 2025-07-22 | A vulnerability classified as critical has been found in jshERP up to 3.5. Affected is an unknown function of the file /user/delete of the component Account Ha… |
CVE-2025-7938 | Medium | 4.3 | 2025-07-21 | A vulnerability was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 1.0 and classified as critical. This issue affects the function updateGoods of the file GoodsC… |
CVE-2025-49746 | Critical | 9.9 | 2025-07-18 | Improper authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network. |
CVE-2025-46732 | Medium | 5.4 | 2025-07-18 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.6.6, an IDOR vulnerability in the GrapQ… |
CVE-2025-50073 | Medium | 6.1 | 2025-07-15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.2.1.4… |
CVE-2024-26291 | | 2025-07-14 | An Unauthenticated Arbitrary File Read vulnerability affects the Agent when installed on a system. The parameter filename does not validate the path thus allow… | |
CVE-2025-53709 | Medium | 5.4 | 2025-07-10 | Secure-upload is a data submission service that validates single-use tokens when accepting submissions to channels. The service only installed on a small numbe… |
CVE-2025-0928 | High | 8.8 | 2025-07-08 | In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent binaries to any model or to the controller… |
CVE-2025-53512 | Medium | 6.5 | 2025-07-08 | The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitiv… |
CVE-2025-49701 | High | 8.8 | 2025-07-08 | Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2025-53532 | Medium | 5.3 | 2025-07-07 | giscus is a commenting system powered by GitHub Discussions. A bug in giscus' discussions creation API allowed an unauthorized user to create discussions on an… |
CVE-2025-6713 | High | 7.7 | 2025-07-07 | An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCu… |
CVE-2025-53106 | High | 8.8 | 2025-07-02 | Graylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-rc.2, Graylog users can gain elevated p… |
CVE-2025-4654 | Low | 3.7 | 2025-07-02 | The Soumettre.fr plugin for WordPress is vulnerable to unauthorized access and modification of data due to a improper authorization checks on the make_signatur… |
CVE-2025-6736 | Medium | 6.3 | 2025-06-27 | A vulnerability classified as critical was found in juzaweb CMS 3.4.2. Affected by this vulnerability is an unknown functionality of the file /admin-cp/theme/i… |
CVE-2025-6735 | Medium | 6.3 | 2025-06-27 | A vulnerability classified as critical has been found in juzaweb CMS 3.4.2. Affected is an unknown function of the file /admin-cp/imports of the component Impo… |
CVE-2025-6702 | Medium | 4.3 | 2025-06-26 | A vulnerability, which was classified as problematic, was found in linlinjava litemall 1.8.0. Affected is an unknown function of the file /wx/comment/post. The… |
CVE-2025-20264 | Medium | 6.4 | 2025-06-25 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass the autho… |
CVE-2025-6431 | Medium | 6.5 | 2025-06-24 | When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker could have bypassed th… |
CVE-2025-6525 | Medium | 4.3 | 2025-06-23 | A vulnerability classified as problematic was found in 70mai 1S up to 20250611. This vulnerability affects unknown code of the file /cgi-bin/Config.cgi?action=… |
CVE-2025-6329 | Medium | 5.4 | 2025-06-20 | A vulnerability was found in ScriptAndTools Real Estate Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the… |
CVE-2025-6099 | Medium | 5.3 | 2025-06-16 | A vulnerability was found in szluyu99 gin-vue-blog up to 61dd11ccd296e8642a318ada3ef7b3f7776d2410. It has been declared as critical. This vulnerability affects… |
CVE-2025-22239 | High | 8.1 | 2025-06-13 | Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's e… |
CVE-2025-46840 | High | 8.7 | 2025-06-10 | Adobe Experience Manager versions 6.5.22 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. A low p… |
CVE-2024-43706 | High | 7.6 | 2025-06-10 | Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint. |
CVE-2025-43585 | High | 8.2 | 2025-06-10 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Authorization vulnerability that could result… |
CVE-2025-5522 | High | 7.3 | 2025-06-03 | A vulnerability was found in jack0240 魏 bskms 蓝天幼儿园管理系统 up to dffe6640b5b54d8e29da6f060e0493fea74b3fad. It has been rated as critical. Affected by this issue i… |
CVE-2025-5511 | Medium | 5.3 | 2025-06-03 | A vulnerability, which was classified as critical, has been found in quequnlong shiyi-blog up to 1.2.1. This issue affects some unknown processing of the file… |
CVE-2025-3454 | Medium | 5.0 | 2025-06-02 | This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with… |
CVE-2025-4672 | High | 8.8 | 2025-05-31 | The Offsprout Page Builder plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization placed on the permission_callback() functio… |
CVE-2025-4631 | Critical | 9.8 | 2025-05-31 | The Profitori plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the stocktend_object endpoint in versions 2.0.6.0… |
CVE-2025-4103 | High | 8.8 | 2025-05-31 | The WP-GeoMeta plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wp_ajax_wpgm_start_geojson_import() function… |
CVE-2025-5182 | Medium | 4.3 | 2025-05-26 | A vulnerability has been found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1 and classified as critical. This vulnerability affects unk… |
CVE-2025-5175 | Medium | 5.3 | 2025-05-26 | A vulnerability was found in erdogant pypickle up to 1.1.5. It has been classified as critical. This affects the function Save of the file pypickle/pypickle.py… |
CVE-2025-48371 | High | 8.8 | 2025-05-22 | OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 (corresponding to Helm chart openfga-0.2.16 through openfga-0.2.30 and doc… |
CVE-2025-48063 | High | 8.8 | 2025-05-21 | XWiki is a generic wiki platform. In XWiki 16.10.0, required rights were introduced as a way to limit which rights a document can have. Part of the security mo… |
CVE-2025-4819 | Low | 3.1 | 2025-05-17 | A vulnerability classified as problematic has been found in y_project RuoYi 4.8.0. Affected is an unknown function of the file /monitor/online/batchForceLogout… |
CVE-2025-4474 | High | 8.8 | 2025-05-13 | The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fed_admin_setting_form_function() fu… |
CVE-2025-4473 | High | 8.8 | 2025-05-13 | The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_request() function in versions… |
CVE-2025-31249 | High | 7.1 | 2025-05-12 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive user data. |
CVE-2025-29827 | Critical | 9.9 | 2025-05-08 | Improper authorization in Azure Automation allows an authorized attacker to elevate privileges over a network. |
CVE-2025-4104 | Critical | 9.8 | 2025-05-07 | The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fed_wp_ajax_fed_login_form_post() fu… |
CVE-2025-3924 | Medium | 5.3 | 2025-05-07 | The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized access of data via its publicly exposed reset-password endpoint. The… |
CVE-2025-3921 | High | 8.2 | 2025-05-07 | The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handel… |
CVE-2025-3918 | Critical | 9.8 | 2025-05-03 | The Job Listings plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the register_action() function in versions 0.1… |
CVE-2025-4210 | High | 7.3 | 2025-05-02 | A vulnerability classified as critical was found in Casdoor up to 1.811.0. This vulnerability affects the function HandleScim of the file controllers/scim.go o… |
CVE-2025-4136 | Medium | 5.4 | 2025-04-30 | A vulnerability was found in Weitong Mall 1.0.0. It has been classified as critical. This affects an unknown part of the component Sale Endpoint. The manipulat… |
CVE-2025-30392 | Critical | 9.8 | 2025-04-30 | Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network. |