CWE-287 · Improper Authentication (page 10)
Page 10 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-6172 | Critical | 9.8 | 2025-06-16 | Permission vulnerability in the mobile application (com.afmobi.boomplayer) may lead to the risk of unauthorized operation. |
CVE-2025-6083 | Medium | 4.3 | 2025-06-13 | In ExtremeCloud Universal ZTNA, a syntax error in the 'searchKeyword' condition caused queries to bypass the owner_id filter. This issue may allow users to sea… |
CVE-2025-22236 | High | 8.1 | 2025-06-13 | Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (>= 3007… |
CVE-2024-38825 | Medium | 6.4 | 2025-06-13 | The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate… |
CVE-2024-38822 | Low | 2.7 | 2025-06-13 | Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion. |
CVE-2025-49146 | High | 8.2 | 2025-06-11 | pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to requir… |
CVE-2025-5985 | High | 7.3 | 2025-06-10 | A vulnerability was found in code-projects School Fees Payment System 1.0 and classified as critical. Affected by this issue is some unknown functionality. The… |
CVE-2025-5906 | High | 7.3 | 2025-06-10 | A vulnerability classified as critical has been found in code-projects Laundry System 1.0. This affects an unknown part of the file /data/. The manipulation le… |
CVE-2025-29627 | Medium | 6.8 | 2025-06-09 | An issue in KeeperChat IOS Application v.5.8.8 allows a physically proximate attacker to escalate privileges via the Biometric Authentication Module |
CVE-2025-5876 | Medium | 5.3 | 2025-06-09 | A vulnerability classified as problematic was found in Lucky LM-520-SC, LM-520-FSC and LM-520-FSC-SAM up to 20250321. Affected by this vulnerability is an unkn… |
CVE-2025-5872 | Medium | 5.3 | 2025-06-09 | A vulnerability was found in eGauge EG3000 Energy Monitor 3.6.3. It has been classified as problematic. This affects an unknown part of the component Setting H… |
CVE-2025-5871 | Medium | 5.3 | 2025-06-09 | A vulnerability was found in Papendorf SOL Connect Center 3.3.0.0 and classified as problematic. Affected by this issue is some unknown functionality of the co… |
CVE-2025-5870 | High | 7.3 | 2025-06-09 | A vulnerability has been found in TRENDnet TV-IP121W 1.1.1 Build 36 and classified as critical. Affected by this vulnerability is an unknown functionality of t… |
CVE-2024-13088 | High | 7.8 | 2025-06-06 | An improper authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability… |
CVE-2025-48909 | High | 7.1 | 2025-06-06 | Bypass vulnerability in the device management channel Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-49012 | Medium | 5.4 | 2025-06-05 | Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau versions 0.9.0 through 0.9.14 and 1.00-alpha are vulnerable to a pr… |
CVE-2025-5597 | | 2025-06-04 | Improper Authentication vulnerability in WF Steuerungstechnik GmbH airleader MASTER allows Authentication Bypass.This issue affects airleader MASTER: 3.00571. | |
CVE-2025-49001 | Critical | 9.8 | 2025-06-03 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.10, secret verification does not take effect successfully… |
CVE-2025-5512 | High | 7.3 | 2025-06-03 | A vulnerability, which was classified as critical, was found in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file /api/sys/user/ve… |
CVE-2025-46548 | Medium | 6.5 | 2025-06-03 | If you enable Basic Authentication in Pekko Management using the Java DSL, the authenticator may not be properly applied. Users that rely on authentication i… |
CVE-2025-5495 | High | 7.3 | 2025-06-03 | A vulnerability was found in Netgear WNR614 1.1.0.28_1.0.1WW. It has been classified as critical. This affects an unknown part of the component URL Handler. Th… |
CVE-2025-37093 | Critical | 9.8 | 2025-06-02 | An authentication bypass vulnerability exists in HPE StoreOnce Software. |
CVE-2025-5437 | Medium | 5.3 | 2025-06-02 | A vulnerability classified as critical has been found in Multilaser Sirius RE016 MLT1.0. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi of th… |
CVE-2025-31264 | Medium | 4.6 | 2025-05-29 | An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An… |
CVE-2025-48746 | Medium | 6.5 | 2025-05-28 | Netwrix Directory Manager (formerly Imanami GroupID) v.11.0.0.0 and before, as well as after v.11.1.25134.03 lacks Authentication for a Critical Function. |
CVE-2025-48370 | | 2025-05-27 | auth-js is an isomorphic Javascript library for Supabase Auth. Prior to version 2.70.0, the library functions getUserById, deleteUser, updateUserById, listFact… | |
CVE-2025-5247 | High | 7.3 | 2025-05-27 | A vulnerability, which was classified as critical, has been found in Gowabby HFish 0.1. This issue affects the function LoadUrl of the file \view\url.go. The m… |
CVE-2025-5149 | Medium | 5.6 | 2025-05-25 | A vulnerability was found in WCMS up to 8.3.11. It has been declared as critical. Affected by this vulnerability is the function getMemberByUid of the file /in… |
CVE-2024-7487 | Medium | 5.8 | 2025-05-22 | An improper authentication vulnerability exists in WSO2 Identity Server 7.0.0 due to an implementation flaw that allows app-native authentication to be bypasse… |
CVE-2024-41199 | High | 7.2 | 2025-05-22 | An issue in Ocuco Innovation - JOBMANAGER.EXE v2.10.24.16 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP… |
CVE-2024-41198 | Critical | 9.8 | 2025-05-22 | An issue in Ocuco Innovation - REPORTS.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP pac… |
CVE-2024-41197 | Critical | 9.8 | 2025-05-22 | An issue in Ocuco Innovation - INVCLIENT.EXE v2.10.24.5 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP pa… |
CVE-2024-41196 | Critical | 9.8 | 2025-05-22 | An issue in Ocuco Innovation - REPORTSERVER.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TC… |
CVE-2024-41195 | Critical | 9.8 | 2025-05-22 | An issue in Ocuco Innovation - INNOVASERVICEINTF.EXE v2.10.24.17 allows attackers to bypass authentication and escalate privileges to Administrator via a craft… |
CVE-2025-32815 | Medium | 6.5 | 2025-05-22 | An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur. |
CVE-2025-0605 | Medium | 4.6 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.8 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Group access contro… |
CVE-2025-44083 | Critical | 9.8 | 2025-05-21 | An issue in D-Link DI-8100 16.07.26A1 allows a remote attacker to bypass administrator login authentication |
CVE-2025-4978 | Critical | 9.8 | 2025-05-20 | A vulnerability, which was classified as very critical, was found in Netgear DGND3700 1.1.00.15_1.00.15NA. This affects an unknown part of the file /BRS_top.ht… |
CVE-2025-47790 | Medium | 6.4 | 2025-05-16 | Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13… |
CVE-2025-4755 | High | 7.3 | 2025-05-16 | A vulnerability was found in D-Link DI-7003GV2 24.04.18D1 R(68125). It has been classified as critical. This affects the function sub_497DE4 of the file /H5/ne… |
CVE-2025-47275 | Critical | 9.1 | 2025-05-15 | Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs. Starting in version 8.0.0-BETA1 and prior to version 8.14.0, session cookies of ap… |
CVE-2025-47889 | Critical | 9.8 | 2025-05-14 | In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticate… |
CVE-2025-20083 | High | 7.5 | 2025-05-13 | Improper authentication in the firmware for the Intel(R) Slim Bootloader may allow a privileged user to potentially enable escalation of privilege via local ac… |
CVE-2025-26685 | Medium | 6.5 | 2025-05-13 | Improper authentication in Microsoft Defender for Identity allows an unauthorized attacker to perform spoofing over an adjacent network. |
CVE-2025-31228 | Medium | 6.8 | 2025-05-12 | The issue was addressed with improved authentication. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. An attacker with physical access to a dev… |
CVE-2025-3659 | | 2025-05-12 | Improper authentication handling was identified in a set of HTTP POST requests affecting the following product families: * Digi PortServer TS - prior to a… | |
CVE-2025-4494 | High | 7.3 | 2025-05-09 | A vulnerability, which was classified as critical, was found in JAdmin-JAVA JAdmin 1.0. Affected is the function toLogin of the file NoNeedLoginController.java… |
CVE-2025-29813 | Critical | 10.0 | 2025-05-08 | Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network. |
CVE-2024-11186 | Critical | 10.0 | 2025-05-08 | On affected versions of the CloudVision Portal, improper access controls could enable a malicious authenticated user to take broader actions on managed EOS dev… |
CVE-2025-46573 | | 2025-05-06 | passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including versi… | |
CVE-2025-46572 | | 2025-05-06 | passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including versi… | |
CVE-2025-22477 | High | 8.3 | 2025-05-06 | Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with adjacent… |
CVE-2025-46590 | Medium | 6.3 | 2025-05-06 | Bypass vulnerability in the network search instruction authentication module Impact: Successful exploitation of this vulnerability can bypass authentication an… |
CVE-2025-0217 | High | 7.8 | 2025-05-05 | BeyondTrust Privileged Remote Access (PRA) versions prior to 25.1 are vulnerable to a local authentication bypass. A local authenticated attacker can view the… |
CVE-2025-25504 | Medium | 6.5 | 2025-05-05 | An issue in the /usr/local/bin/jncs.sh script of Gefen WebFWC (In AV over IP products) v1.85h, v1.86v, and v1.70 allows attackers with network access to connec… |
CVE-2025-4268 | Medium | 5.3 | 2025-05-05 | A vulnerability has been found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/cstecgi.c… |
CVE-2025-46631 | Medium | 6.5 | 2025-05-01 | Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable telnet access to the… |
CVE-2025-46630 | Medium | 6.5 | 2025-05-01 | Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable 'ate' (a remote syst… |
CVE-2025-4144 | Critical | 9.8 | 2025-05-01 | PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However… |
CVE-2025-29906 | High | 8.6 | 2025-04-29 | Finit is a fast init for Linux systems. Versions starting from 3.0-rc1 and prior to version 4.11 bundle an implementation of getty for the `tty` configuration… |
CVE-2025-46348 | Critical | 10.0 | 2025-04-29 | YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication… |
CVE-2025-3910 | Medium | 5.4 | 2025-04-29 | A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirem… |
CVE-2025-4019 | High | 7.3 | 2025-04-28 | A vulnerability, which was classified as critical, was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. Affected is the function ge… |
CVE-2025-4018 | Medium | 5.3 | 2025-04-28 | A vulnerability, which was classified as critical, has been found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This issue affects the… |
CVE-2025-4015 | Medium | 5.3 | 2025-04-28 | A vulnerability was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. It has been rated as critical. Affected by this issue is the f… |
CVE-2025-3627 | Medium | 4.3 | 2025-04-25 | A security vulnerability was discovered in Moodle that allows some users to access sensitive information about other students before they finish verifying thei… |
CVE-2025-3634 | Medium | 4.3 | 2025-04-25 | A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary safety checks. Spec… |
CVE-2024-11917 | High | 8.1 | 2025-04-25 | The JobSearch WP Job Board plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.9.2. This is due to improper con… |
CVE-2025-2771 | Medium | 5.3 | 2025-04-23 | BEC Technologies Multiple Routers Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installa… |
CVE-2023-44752 | Critical | 9.8 | 2025-04-22 | An issue in Student Study Center Desk Management System v1.0 allows attackers to bypass authentication via a crafted GET request to /php-sscdms/admin/login.php. |
CVE-2025-3850 | Low | 3.7 | 2025-04-22 | A vulnerability, which was classified as problematic, has been found in YXJ2018 SpringBoot-Vue-OnlineExam 1.0. This issue affects some unknown processing of th… |
CVE-2025-27086 | High | 8.1 | 2025-04-21 | A vulnerability in the HPE Performance Cluster Manager (HPCM) GUI could allow an attacker to bypass authentication. |
CVE-2025-31478 | High | 8.2 | 2025-04-16 | Zulip is an open-source team collaboration tool. Zulip supports a configuration where account creation is limited solely by being able to authenticate with a s… |
CVE-2025-30215 | Critical | 9.6 | 2025-04-16 | NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11… |
CVE-2025-30733 | Medium | 6.5 | 2025-04-15 | Vulnerability in the RDBMS Listener component of Oracle Database Server. Supported versions that are affected are 19.3-19.26, 21.3-21.17 and 23.4-23.7. Easil… |
CVE-2024-44843 | Medium | 5.9 | 2025-04-15 | An issue in the web socket handshake process of SteVe v3.7.1 allows attackers to bypass authentication and execute arbitrary coammands via supplying crafted OC… |
CVE-2025-24949 | Medium | 6.5 | 2025-04-15 | In JotUrl 2.0, is possible to bypass security requirements during the password change process. |
CVE-2025-2572 | Medium | 5.6 | 2025-04-14 | In WhatsUp Gold versions released before 2024.0.3, a database manipulation vulnerability allows an unauthenticated attacker to modify the contents of Whats… |
CVE-2025-22232 | Medium | 5.3 | 2025-04-10 | Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affecte… |
CVE-2025-22375 | | 2025-04-10 | An authentication bypass vulnerability was found in Videx's CyberAudit-Web. Through the exploitation of a logic flaw, an attacker could create a valid session… | |
CVE-2025-30287 | High | 8.2 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution… |
CVE-2025-30282 | Critical | 9.1 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution… |
CVE-2025-25227 | High | 7.5 | 2025-04-08 | Insufficient state checks lead to a vector that allows to bypass 2FA checks. |
CVE-2025-3268 | Medium | 5.3 | 2025-04-04 | A vulnerability has been found in qinguoyi TinyWebServer up to 1.0 and classified as critical. This vulnerability affects unknown code of the file http/http_co… |
CVE-2025-3062 | Medium | 6.6 | 2025-03-31 | Vulnerability in Drupal Drupal Admin LTE theme.This issue affects Drupal Admin LTE theme: *.*. |
CVE-2025-3061 | Medium | 6.6 | 2025-03-31 | Vulnerability in Drupal Material Admin.This issue affects Material Admin: *.*. |
CVE-2025-30432 | Medium | 6.4 | 2025-03-31 | A logic issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sonoma 14.7.5, macOS Ventura… |
CVE-2025-30430 | Critical | 9.8 | 2025-03-31 | This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, watchOS 11.4. Pa… |
CVE-2025-31122 | | 2025-03-31 | scratch-coding-hut.github.io is the website for Coding Hut. In 1.0-beta3 and earlier, the login link can be used to login to any account by changing the userna… | |
CVE-2024-13804 | Critical | 9.8 | 2025-03-30 | Unauthenticated RCE in HPE Insight Cluster Management Utility |
CVE-2025-2859 | Critical | 9.8 | 2025-03-28 | An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the… |
CVE-2025-30361 | Critical | 9.8 | 2025-03-27 | WeGIA is a Web manager for charitable institutions. A security vulnerability was identified in versions prior to 3.2.6, where it is possible to change a user's… |
CVE-2025-30214 | High | 7.5 | 2025-03-25 | Frappe is a full-stack web application framework. Prior to versions 14.89.0 and 15.51.0, making crafted requests could lead to information disclosure that coul… |
CVE-2025-30168 | Medium | 6.9 | 2025-03-21 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 7.5.2 and 8.0.2, the 3rd party authentication… |
CVE-2024-57490 | High | 7.7 | 2025-03-21 | Guangzhou Hongfan Technology Co., LTD. iOffice20 has any user login vulnerability. An attacker can log in to any system account including the system administra… |
CVE-2025-22228 | High | 7.4 | 2025-03-20 | BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are… |
CVE-2025-26475 | Medium | 5.5 | 2025-03-19 | Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.26, Enables Live-Restore setting which enhances security by keeping containers running duri… |
CVE-2025-30116 | High | 7.5 | 2025-03-18 | An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Remotely Dumping of Video Footage and the Live Video Stream can occur. It allows rem… |
CVE-2025-30114 | Critical | 9.1 | 2025-03-18 | An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Bypassing of Device Pairing can occur. The pairing mechanism relies solely on the co… |
CVE-2025-2388 | High | 7.3 | 2025-03-17 | A vulnerability was found in Keytop 路内停车收费系统 2.7.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /s… |