CWE-287 · Improper Authentication (page 13)
Page 13 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-55293 | Critical | 9.4 | 2025-08-18 | Meshtastic is an open source mesh networking solution. Prior to v2.6.3, an attacker can send NodeInfo with a empty publicKey first, then overwrite it with a ne… |
CVE-2025-9100 | Medium | 5.3 | 2025-08-18 | A security flaw has been discovered in zhenfeng13 My-Blog 1.0.0. This vulnerability affects unknown code of the file /blog/comment of the component Frontend Bl… |
CVE-2025-8964 | Medium | 5.3 | 2025-08-14 | A vulnerability was identified in code-projects Hostel Management System 1.0. This affects an unknown part of the file hostel_manage.exe of the component Login… |
CVE-2025-51451 | Critical | 9.8 | 2025-08-13 | In TOTOLINK EX1200T firmware 4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm. |
CVE-2025-55171 | High | 7.5 | 2025-08-12 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, the application does not check… |
CVE-2025-55169 | Medium | 6.5 | 2025-08-12 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path traversal vulnerability… |
CVE-2025-53793 | High | 7.5 | 2025-08-12 | Improper authentication in Azure Stack allows an unauthorized attacker to disclose information over a network. |
CVE-2025-53778 | High | 8.8 | 2025-08-12 | Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network. |
CVE-2025-8838 | High | 7.3 | 2025-08-11 | A vulnerability has been found in WinterChenS my-site up to 1f7525f15934d9d6a278de967f6ec9f1757738d8. This vulnerability affects the function preHandle of the… |
CVE-2025-54888 | | 2025-08-09 | Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636… | |
CVE-2025-54786 | Medium | 5.3 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authenticati… |
CVE-2025-53786 | High | 8.0 | 2025-08-06 | On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these cha… |
CVE-2025-8546 | Medium | 5.3 | 2025-08-05 | A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. This affects the function adminlogin/login of the component Verific… |
CVE-2025-8348 | High | 7.3 | 2025-07-31 | A vulnerability has been found in Kehua Charging Pile Cloud Platform 1.0 and classified as critical. This vulnerability affects unknown code of the file /home… |
CVE-2025-54573 | Medium | 4.3 | 2025-07-30 | CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.1.0 through 2.41.0, email verification was not enforced w… |
CVE-2025-6505 | High | 8.1 | 2025-07-29 | Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux. This vulnerabilit… |
CVE-2025-54419 | Critical | 10.0 | 2025-07-28 | A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the (unsigned) original response documen… |
CVE-2025-45777 | Critical | 9.8 | 2025-07-25 | An issue in the OTP mechanism of Chavara Family Welfare Centre Chavara Matrimony Site v2.0 allows attackers to bypass authentication via supplying a crafted re… |
CVE-2025-0249 | Low | 3.3 | 2025-07-25 | HCL IEM is affected by an improper invalidation of access or JWT token vulnerability. A token was not invalidated which may allow attackers to access sensitiv… |
CVE-2024-12310 | | 2025-07-23 | A vulnerability in Imprivata Enterprise Access Management (formerly Imprivata OneSign) allows bypassing the login screen of the shared kiosk workstation and al… | |
CVE-2025-54452 | High | 7.3 | 2025-07-23 | Improper Authentication vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less than 2… |
CVE-2025-41459 | High | 7.8 | 2025-07-21 | Insufficient protection against brute-force and runtime manipulation in the local authentication component in Two App Studio Journey 5.5.6 on iOS allows local… |
CVE-2024-6107 | Critical | 9.6 | 2025-07-21 | Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. This has been addr… |
CVE-2025-53771 | Medium | 6.5 | 2025-07-20 | Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-7897 | High | 7.3 | 2025-07-20 | A vulnerability was found in harry0703 MoneyPrinterTurbo up to 1.2.6 and classified as critical. Affected by this issue is the function verify_token of the fil… |
CVE-2025-7875 | High | 7.3 | 2025-07-20 | A vulnerability classified as critical has been found in Metasoft 美特软件 MetaCRM up to 6.4.2. This affects an unknown part of the file /debug.jsp. The manipulati… |
CVE-2025-7862 | High | 7.3 | 2025-07-20 | A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setTelnetCfg of… |
CVE-2025-37107 | High | 7.3 | 2025-07-16 | An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18. |
CVE-2025-37106 | High | 7.3 | 2025-07-16 | An authentication bypass and disclosure of information vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18. |
CVE-2025-7699 | | 2025-07-16 | An improper access control vulnerability was found in the EZ Sync Manager of ADM, which allows authenticated users to copy arbitrary files from the server fil… | |
CVE-2025-7703 | Low | 3.1 | 2025-07-16 | Authentication vulnerability in the mobile application（tech.palm.id）may lead to the risk of information leakage. |
CVE-2025-49831 | Critical | 9.8 | 2025-07-15 | An attacker of Secrets Manager, Self-Hosted installations that route traffic from Secrets Manager to AWS through a misconfigured network device can reroute aut… |
CVE-2025-52376 | Critical | 9.8 | 2025-07-15 | An authentication bypass vulnerability in the /web/um_open_telnet.cgi endpoint in Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below, allowing an… |
CVE-2025-3621 | Critical | 9.6 | 2025-07-15 | Vulnerabilities* in ActADUR local server product, developed and maintained by ProTNS, allows Remote Code Inclusion on host systems. * vulnerabilities: *… |
CVE-2025-53889 | Medium | 6.5 | 2025-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.9.0, Directus Flows with a… |
CVE-2024-51767 | High | 7.3 | 2025-07-14 | An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2025-7574 | Critical | 9.8 | 2025-07-14 | A vulnerability, which was classified as critical, was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702… |
CVE-2025-31267 | Medium | 4.6 | 2025-07-10 | An authentication issue was addressed with improved state management. This issue is fixed in App Store Connect 3.0. An attacker with physical access to an unlo… |
CVE-2025-49812 | High | 7.4 | 2025-07-10 | In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack… |
CVE-2025-49706 | Medium | 6.5 | 2025-07-08 | Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-53545 | | 2025-07-08 | Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Users can circumvent 2F… | |
CVE-2025-21450 | Critical | 9.1 | 2025-07-08 | Cryptographic issue occurs due to use of insecure connection method while downloading. |
CVE-2025-6044 | Medium | 6.1 | 2025-07-07 | An Improper Access Control vulnerability in the Stylus Tools component of Google ChromeOS version 16238.64.0 on the garaged stylus devices allows a physical at… |
CVE-2025-7115 | High | 7.3 | 2025-07-07 | A vulnerability was found in rowboatlabs rowboat up to 8096eaf63b5a0732edd8f812bee05b78e214ee97. It has been rated as critical. Affected by this issue is the f… |
CVE-2025-7114 | High | 7.3 | 2025-07-07 | A vulnerability was found in SimStudioAI sim up to 37786d371e17d35e0764e1b5cd519d873d90d97b. It has been declared as critical. Affected by this vulnerability i… |
CVE-2025-53169 | High | 7.6 | 2025-07-07 | Vulnerability of bypassing the process to start SA and use related functions on distributed cameras Impact: Successful exploitation of this vulnerability may a… |
CVE-2025-7095 | Low | 3.7 | 2025-07-06 | A vulnerability classified as critical has been found in Comodo Internet Security Premium 12.3.4.8162. This affects an unknown part of the component Update Han… |
CVE-2025-6926 | High | 8.8 | 2025-07-03 | Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication.This issue affects Mediawiki - C… |
CVE-2025-52294 | Medium | 5.7 | 2025-07-01 | Insufficient validation of the screen lock mechanism in Trust Wallet v8.45 allows physically proximate attackers to bypass the lock screen and view the wallet… |
CVE-2025-6916 | High | 8.8 | 2025-06-30 | A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. This affects the function Form_Login of the file /formLoginA… |
CVE-2025-24292 | Medium | 6.8 | 2025-06-29 | A misconfigured query in UniFi Network (v9.1.120 and earlier) could allow users to authenticate to Enterprise WiFi or VPN Server (l2tp and OpenVPN) using a dev… |
CVE-2025-52553 | Critical | 9.6 | 2025-06-27 | authentik is an open-source identity provider. After authorizing access to a RAC endpoint, authentik creates a token which is used for a single connection and… |
CVE-2025-6763 | High | 8.1 | 2025-06-27 | A vulnerability was found in Comet System T0510, T3510, T3511, T4511, T6640, T7511, T7611, P8510, P8552 and H3531 1.60. Affected by this issue is some unknown… |
CVE-2025-53013 | Medium | 5.2 | 2025-06-26 | Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. A vulnerability present in versions 0.9.10 through 0.9.16 allows a user to aut… |
CVE-2024-6174 | High | 8.8 | 2025-06-26 | When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configuratio… |
CVE-2025-52572 | Critical | 10.0 | 2025-06-24 | Hikka, a Telegram userbot, has vulnerability affects all users on all versions of Hikka. Two scenarios are possible. 1. Web interface does not have an authenti… |
CVE-2025-52571 | Critical | 9.6 | 2025-06-24 | Hikka is a Telegram userbot. A vulnerability affects all users of versions below 1.6.2, including most of the forks. It allows an unauthenticated attacker to g… |
CVE-2025-49851 | Critical | 9.8 | 2025-06-24 | ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to an improper authentication vulnerability which could allow an attacker to bypass a… |
CVE-2025-32975 | Critical | 10.0 | 2025-06-24 | Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1… |
CVE-2025-6533 | Medium | 5.6 | 2025-06-24 | A vulnerability, which was classified as critical, has been found in xxyopen/201206030 novel-plus up to 5.1.3. Affected by this issue is the function ajaxLogin… |
CVE-2025-6528 | Medium | 4.3 | 2025-06-23 | A vulnerability has been found in 70mai M300 up to 20250611 and classified as problematic. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2025-6524 | Low | 3.1 | 2025-06-23 | A vulnerability classified as problematic has been found in 70mai 1S up to 20250611. This affects an unknown part of the component Video Services. The manipula… |
CVE-2024-45347 | Critical | 9.6 | 2025-06-23 | An unauthorized access vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be expl… |
CVE-2025-32879 | High | 8.8 | 2025-06-20 | An issue was discovered on COROS PACE 3 devices through 3.0808.0. It starts advertising if no device is connected via Bluetooth. This allows an attacker to con… |
CVE-2025-32877 | Critical | 9.8 | 2025-06-20 | An issue was discovered on COROS PACE 3 devices through 3.0808.0. It identifies itself as a device without input or output capabilities, which results in the u… |
CVE-2025-32875 | Medium | 5.7 | 2025-06-20 | An issue was discovered in the COROS application through 3.8.12 for Android. Bluetooth pairing and bonding is neither initiated nor enforced by the application… |
CVE-2025-49591 | Critical | 9.1 | 2025-06-18 | CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) in CryptPad can be trivially bypassed, due to weak… |
CVE-2025-6172 | Critical | 9.8 | 2025-06-16 | Permission vulnerability in the mobile application (com.afmobi.boomplayer) may lead to the risk of unauthorized operation. |
CVE-2025-6083 | Medium | 4.3 | 2025-06-13 | In ExtremeCloud Universal ZTNA, a syntax error in the 'searchKeyword' condition caused queries to bypass the owner_id filter. This issue may allow users to sea… |
CVE-2025-22236 | High | 8.1 | 2025-06-13 | Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (>= 3007… |
CVE-2024-38825 | Medium | 6.4 | 2025-06-13 | The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate… |
CVE-2024-38822 | Low | 2.7 | 2025-06-13 | Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion. |
CVE-2025-49146 | High | 8.2 | 2025-06-11 | pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to requir… |
CVE-2025-5985 | High | 7.3 | 2025-06-10 | A vulnerability was found in code-projects School Fees Payment System 1.0 and classified as critical. Affected by this issue is some unknown functionality. The… |
CVE-2025-5906 | High | 7.3 | 2025-06-10 | A vulnerability classified as critical has been found in code-projects Laundry System 1.0. This affects an unknown part of the file /data/. The manipulation le… |
CVE-2025-29627 | Medium | 6.8 | 2025-06-09 | An issue in KeeperChat IOS Application v.5.8.8 allows a physically proximate attacker to escalate privileges via the Biometric Authentication Module |
CVE-2025-5876 | Medium | 5.3 | 2025-06-09 | A vulnerability classified as problematic was found in Lucky LM-520-SC, LM-520-FSC and LM-520-FSC-SAM up to 20250321. Affected by this vulnerability is an unkn… |
CVE-2025-5872 | Medium | 5.3 | 2025-06-09 | A vulnerability was found in eGauge EG3000 Energy Monitor 3.6.3. It has been classified as problematic. This affects an unknown part of the component Setting H… |
CVE-2025-5871 | Medium | 5.3 | 2025-06-09 | A vulnerability was found in Papendorf SOL Connect Center 3.3.0.0 and classified as problematic. Affected by this issue is some unknown functionality of the co… |
CVE-2025-5870 | High | 7.3 | 2025-06-09 | A vulnerability has been found in TRENDnet TV-IP121W 1.1.1 Build 36 and classified as critical. Affected by this vulnerability is an unknown functionality of t… |
CVE-2024-13088 | High | 7.8 | 2025-06-06 | An improper authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability… |
CVE-2025-48909 | High | 7.1 | 2025-06-06 | Bypass vulnerability in the device management channel Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-49012 | Medium | 5.4 | 2025-06-05 | Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau versions 0.9.0 through 0.9.14 and 1.00-alpha are vulnerable to a pr… |
CVE-2025-5597 | | 2025-06-04 | Improper Authentication vulnerability in WF Steuerungstechnik GmbH airleader MASTER allows Authentication Bypass.This issue affects airleader MASTER: 3.00571. | |
CVE-2025-49001 | Critical | 9.8 | 2025-06-03 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.10, secret verification does not take effect successfully… |
CVE-2025-5512 | High | 7.3 | 2025-06-03 | A vulnerability, which was classified as critical, was found in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file /api/sys/user/ve… |
CVE-2025-46548 | Medium | 6.5 | 2025-06-03 | If you enable Basic Authentication in Pekko Management using the Java DSL, the authenticator may not be properly applied. Users that rely on authentication i… |
CVE-2025-5495 | High | 7.3 | 2025-06-03 | A vulnerability was found in Netgear WNR614 1.1.0.28_1.0.1WW. It has been classified as critical. This affects an unknown part of the component URL Handler. Th… |
CVE-2025-37093 | Critical | 9.8 | 2025-06-02 | An authentication bypass vulnerability exists in HPE StoreOnce Software. |
CVE-2025-5437 | Medium | 5.3 | 2025-06-02 | A vulnerability classified as critical has been found in Multilaser Sirius RE016 MLT1.0. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi of th… |
CVE-2025-31264 | Medium | 4.6 | 2025-05-29 | An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An… |
CVE-2025-48746 | Medium | 6.5 | 2025-05-28 | Netwrix Directory Manager (formerly Imanami GroupID) v.11.0.0.0 and before, as well as after v.11.1.25134.03 lacks Authentication for a Critical Function. |
CVE-2025-48370 | | 2025-05-27 | auth-js is an isomorphic Javascript library for Supabase Auth. Prior to version 2.70.0, the library functions getUserById, deleteUser, updateUserById, listFact… | |
CVE-2025-5247 | High | 7.3 | 2025-05-27 | A vulnerability, which was classified as critical, has been found in Gowabby HFish 0.1. This issue affects the function LoadUrl of the file \view\url.go. The m… |
CVE-2025-5149 | Medium | 5.6 | 2025-05-25 | A vulnerability was found in WCMS up to 8.3.11. It has been declared as critical. Affected by this vulnerability is the function getMemberByUid of the file /in… |
CVE-2024-7487 | Medium | 5.8 | 2025-05-22 | An improper authentication vulnerability exists in WSO2 Identity Server 7.0.0 due to an implementation flaw that allows app-native authentication to be bypasse… |
CVE-2024-41199 | High | 7.2 | 2025-05-22 | An issue in Ocuco Innovation - JOBMANAGER.EXE v2.10.24.16 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP… |
CVE-2024-41198 | Critical | 9.8 | 2025-05-22 | An issue in Ocuco Innovation - REPORTS.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP pac… |
CVE-2024-41197 | Critical | 9.8 | 2025-05-22 | An issue in Ocuco Innovation - INVCLIENT.EXE v2.10.24.5 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP pa… |
CVE-2024-41196 | Critical | 9.8 | 2025-05-22 | An issue in Ocuco Innovation - REPORTSERVER.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TC… |