CWE-287 · Improper Authentication (page 9)
Page 9 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-45583 | Critical | 9.1 | 2025-09-12 | Incorrect access control in the FTP protocol of Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to authenticate into the service using any combina… |
CVE-2025-10365 | | 2025-09-12 | The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. Thi… | |
CVE-2025-10288 | Medium | 5.3 | 2025-09-12 | A vulnerability was found in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. The impacted element is an unknown function of the file /user/in… |
CVE-2025-58065 | Medium | 6.5 | 2025-09-11 | Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database… |
CVE-2025-58060 | High | 8.0 | 2025-09-11 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the `AuthType` is set… |
CVE-2025-54376 | High | 7.5 | 2025-09-10 | Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same… |
CVE-2025-56578 | Medium | 5.7 | 2025-09-10 | An issue in RTSPtoWeb v.2.4.3 allows a remote attacker to obtain sensitive information and executearbitrary code via the lack of authentication mechanisms |
CVE-2025-10224 | Medium | 5.4 | 2025-09-10 | Improper Authentication (CWE-287) in the LDAP authentication engine in AxxonSoft Axxon One (C-Werk) 2.0.2 and earlier on Windows allows a remote authenticated… |
CVE-2025-57278 | High | 8.8 | 2025-09-09 | The LB-Link BL-CPE300M AX300 4G LTE Router firmware version BL-R8800_B10_ALK_SL_V01.01.02P42U14_06 does not implement proper session handling. After a user aut… |
CVE-2025-55234 | High | 8.8 | 2025-09-09 | SMB Server might be susceptible to relay attacks depending on the configuration. An attacker who successfully exploited these vulnerabilities could perform rel… |
CVE-2025-54918 | High | 8.8 | 2025-09-09 | Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network. |
CVE-2025-9994 | Critical | 9.8 | 2025-09-09 | The Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not have an authentication feature, allowing unauthorized access to anyone with netw… |
CVE-2025-58443 | Critical | 9.1 | 2025-09-06 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1673 and below contain an authentication bypass vulnerabili… |
CVE-2025-55241 | Critical | 10.0 | 2025-09-04 | Azure Entra ID Elevation of Privilege Vulnerability |
CVE-2025-26438 | High | 8.8 | 2025-09-04 | In smp_process_secure_connection_oob_data of smp_act.cc, there is a possible way to bypass SMP authentication due to Incorrect implementation of a protocol. Th… |
CVE-2025-56752 | Critical | 9.4 | 2025-09-03 | A vulnerability in the Ruijie RG-ES series switch firmware ESW_1.0(1)B1P39 enables remote attackers to fully bypass authentication mechanisms, providing them w… |
CVE-2023-21471 | Medium | 4.0 | 2025-09-03 | Improper access control vulnerability in SemClipboard prior to SMR Apr-2023 Release 1 allows attackers to read arbitrary files with system permission. |
CVE-2023-21467 | Medium | 4.6 | 2025-09-03 | Error in 3GPP specification implementation in Exynos baseband prior to SMR Apr-2023 Release 1 allows incorrect handling of unencrypted message. |
CVE-2023-21466 | Medium | 5.3 | 2025-09-03 | PendingIntent hijacking vulnerability in CertificatePolicy in framework prior to SMR Apr-2023 Release 1 allows local attackers to access contentProvider withou… |
CVE-2024-40653 | High | 7.3 | 2025-09-02 | In multiple functions of ConnectionServiceWrapper.java, there is a possible way to retain a permission forever in the background due to a logic error in the co… |
CVE-2025-9815 | High | 7.8 | 2025-09-02 | A weakness has been identified in alaneuler batteryKid up to 2.1 on macOS. The affected element is an unknown function of the file PrivilegeHelper/PrivilegeHel… |
CVE-2025-52856 | Critical | 9.8 | 2025-08-29 | An improper authentication vulnerability has been reported to affect VioStor. If a remote attacker, they can then exploit the vulnerability to compromise the s… |
CVE-2025-52054 | Medium | 5.3 | 2025-08-28 | An issue was discovered in Tenda AC8 v4.0 AC1200 Dual-band Gigabit Wireless Router AC8v4.0 Firmware 16.03.33.05. The root password of the device is calculated… |
CVE-2025-7955 | Critical | 9.8 | 2025-08-28 | The RingCentral Communications plugin for WordPress is vulnerable to Authentication Bypass due to improper validation within the ringcentral_admin_login_2fa_ve… |
CVE-2025-9533 | High | 7.3 | 2025-08-27 | A vulnerability has been found in TOTOLINK T10 4.1.8cu.5241_B20210927. Affected is an unknown function of the file /formLoginAuth.htm. The manipulation of the… |
CVE-2024-52786 | Critical | 9.8 | 2025-08-22 | An authentication bypass vulnerability in anji-plus AJ-Report up to v1.4.2 allows unauthenticated attackers to execute arbitrary code via a crafted URL. |
CVE-2024-50645 | Critical | 9.8 | 2025-08-22 | MallChat v1.0-SNAPSHOT has an authentication bypass vulnerability. An attacker can exploit this vulnerability to access API without any token. |
CVE-2024-50644 | Critical | 9.8 | 2025-08-22 | zhisheng17 blog 3.0.1-SNAPSHOT has an authentication bypass vulnerability. An attacker can exploit this vulnerability to access API without any token. |
CVE-2024-50641 | High | 8.1 | 2025-08-21 | An authentication bypass vulnerability in PandoraNext-TokensTool v0.6.8 and before. An attacker can exploit this vulnerability to access API without any token. |
CVE-2025-52395 | Critical | 9.8 | 2025-08-21 | An issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password reset API endpoint that fails to valida… |
CVE-2025-50901 | Critical | 9.8 | 2025-08-20 | JeeWMS 771e4f5d0c01ffdeae1671be4cf102b73a3fe644 (2025-05-19) contains incorrect authentication bypass vulnerability, which can lead to arbitrary file reading. |
CVE-2024-50640 | Critical | 9.8 | 2025-08-20 | jeewx-boot 1.3 has an authentication bypass vulnerability in the preHandle function |
CVE-2024-57491 | High | 8.8 | 2025-08-20 | Authentication Bypass vulnerability in jobx up to v1.0.1-RELEASE allows an attacker can exploit this vulnerability to access sensitive API without any token vi… |
CVE-2025-55293 | Critical | 9.4 | 2025-08-18 | Meshtastic is an open source mesh networking solution. Prior to v2.6.3, an attacker can send NodeInfo with a empty publicKey first, then overwrite it with a ne… |
CVE-2025-9100 | Medium | 5.3 | 2025-08-18 | A security flaw has been discovered in zhenfeng13 My-Blog 1.0.0. This vulnerability affects unknown code of the file /blog/comment of the component Frontend Bl… |
CVE-2025-8964 | Medium | 5.3 | 2025-08-14 | A vulnerability was identified in code-projects Hostel Management System 1.0. This affects an unknown part of the file hostel_manage.exe of the component Login… |
CVE-2025-51451 | Critical | 9.8 | 2025-08-13 | In TOTOLINK EX1200T firmware 4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm. |
CVE-2025-55171 | High | 7.5 | 2025-08-12 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, the application does not check… |
CVE-2025-55169 | Medium | 6.5 | 2025-08-12 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path traversal vulnerability… |
CVE-2025-53793 | High | 7.5 | 2025-08-12 | Improper authentication in Azure Stack allows an unauthorized attacker to disclose information over a network. |
CVE-2025-53778 | High | 8.8 | 2025-08-12 | Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network. |
CVE-2025-8838 | High | 7.3 | 2025-08-11 | A vulnerability has been found in WinterChenS my-site up to 1f7525f15934d9d6a278de967f6ec9f1757738d8. This vulnerability affects the function preHandle of the… |
CVE-2025-54888 | | 2025-08-09 | Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636… | |
CVE-2025-54786 | Medium | 5.3 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authenticati… |
CVE-2025-53786 | High | 8.0 | 2025-08-06 | On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these cha… |
CVE-2025-8546 | Medium | 5.3 | 2025-08-05 | A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. This affects the function adminlogin/login of the component Verific… |
CVE-2025-8348 | High | 7.3 | 2025-07-31 | A vulnerability has been found in Kehua Charging Pile Cloud Platform 1.0 and classified as critical. This vulnerability affects unknown code of the file /home… |
CVE-2025-54573 | Medium | 4.3 | 2025-07-30 | CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.1.0 through 2.41.0, email verification was not enforced w… |
CVE-2025-6505 | High | 8.1 | 2025-07-29 | Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux. This vulnerabilit… |
CVE-2025-54419 | Critical | 10.0 | 2025-07-28 | A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the (unsigned) original response documen… |
CVE-2025-45777 | Critical | 9.8 | 2025-07-25 | An issue in the OTP mechanism of Chavara Family Welfare Centre Chavara Matrimony Site v2.0 allows attackers to bypass authentication via supplying a crafted re… |
CVE-2025-0249 | Low | 3.3 | 2025-07-25 | HCL IEM is affected by an improper invalidation of access or JWT token vulnerability. A token was not invalidated which may allow attackers to access sensitiv… |
CVE-2024-12310 | | 2025-07-23 | A vulnerability in Imprivata Enterprise Access Management (formerly Imprivata OneSign) allows bypassing the login screen of the shared kiosk workstation and al… | |
CVE-2025-54452 | High | 7.3 | 2025-07-23 | Improper Authentication vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less than 2… |
CVE-2025-41459 | High | 7.8 | 2025-07-21 | Insufficient protection against brute-force and runtime manipulation in the local authentication component in Two App Studio Journey 5.5.6 on iOS allows local… |
CVE-2024-6107 | Critical | 9.6 | 2025-07-21 | Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. This has been addr… |
CVE-2025-53771 | Medium | 6.5 | 2025-07-20 | Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-7897 | High | 7.3 | 2025-07-20 | A vulnerability was found in harry0703 MoneyPrinterTurbo up to 1.2.6 and classified as critical. Affected by this issue is the function verify_token of the fil… |
CVE-2025-7875 | High | 7.3 | 2025-07-20 | A vulnerability classified as critical has been found in Metasoft 美特软件 MetaCRM up to 6.4.2. This affects an unknown part of the file /debug.jsp. The manipulati… |
CVE-2025-7862 | High | 7.3 | 2025-07-20 | A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setTelnetCfg of… |
CVE-2025-37107 | High | 7.3 | 2025-07-16 | An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18. |
CVE-2025-37106 | High | 7.3 | 2025-07-16 | An authentication bypass and disclosure of information vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18. |
CVE-2025-7699 | | 2025-07-16 | An improper access control vulnerability was found in the EZ Sync Manager of ADM, which allows authenticated users to copy arbitrary files from the server fil… | |
CVE-2025-7703 | Low | 3.1 | 2025-07-16 | Authentication vulnerability in the mobile application（tech.palm.id）may lead to the risk of information leakage. |
CVE-2025-49831 | Critical | 9.8 | 2025-07-15 | An attacker of Secrets Manager, Self-Hosted installations that route traffic from Secrets Manager to AWS through a misconfigured network device can reroute aut… |
CVE-2025-52376 | Critical | 9.8 | 2025-07-15 | An authentication bypass vulnerability in the /web/um_open_telnet.cgi endpoint in Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below, allowing an… |
CVE-2025-3621 | Critical | 9.6 | 2025-07-15 | Vulnerabilities* in ActADUR local server product, developed and maintained by ProTNS, allows Remote Code Inclusion on host systems. * vulnerabilities: *… |
CVE-2025-53889 | Medium | 6.5 | 2025-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.9.0, Directus Flows with a… |
CVE-2024-51767 | High | 7.3 | 2025-07-14 | An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2025-7574 | Critical | 9.8 | 2025-07-14 | A vulnerability, which was classified as critical, was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702… |
CVE-2025-31267 | Medium | 4.6 | 2025-07-10 | An authentication issue was addressed with improved state management. This issue is fixed in App Store Connect 3.0. An attacker with physical access to an unlo… |
CVE-2025-49812 | High | 7.4 | 2025-07-10 | In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack… |
CVE-2025-49706 | Medium | 6.5 | 2025-07-08 | Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-53545 | | 2025-07-08 | Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Users can circumvent 2F… | |
CVE-2025-21450 | Critical | 9.1 | 2025-07-08 | Cryptographic issue occurs due to use of insecure connection method while downloading. |
CVE-2025-6044 | Medium | 6.1 | 2025-07-07 | An Improper Access Control vulnerability in the Stylus Tools component of Google ChromeOS version 16238.64.0 on the garaged stylus devices allows a physical at… |
CVE-2025-7115 | High | 7.3 | 2025-07-07 | A vulnerability was found in rowboatlabs rowboat up to 8096eaf63b5a0732edd8f812bee05b78e214ee97. It has been rated as critical. Affected by this issue is the f… |
CVE-2025-7114 | High | 7.3 | 2025-07-07 | A vulnerability was found in SimStudioAI sim up to 37786d371e17d35e0764e1b5cd519d873d90d97b. It has been declared as critical. Affected by this vulnerability i… |
CVE-2025-53169 | High | 7.6 | 2025-07-07 | Vulnerability of bypassing the process to start SA and use related functions on distributed cameras Impact: Successful exploitation of this vulnerability may a… |
CVE-2025-7095 | Low | 3.7 | 2025-07-06 | A vulnerability classified as critical has been found in Comodo Internet Security Premium 12.3.4.8162. This affects an unknown part of the component Update Han… |
CVE-2025-6926 | High | 8.8 | 2025-07-03 | Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication.This issue affects Mediawiki - C… |
CVE-2025-52294 | Medium | 5.7 | 2025-07-01 | Insufficient validation of the screen lock mechanism in Trust Wallet v8.45 allows physically proximate attackers to bypass the lock screen and view the wallet… |
CVE-2025-6916 | High | 8.8 | 2025-06-30 | A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. This affects the function Form_Login of the file /formLoginA… |
CVE-2025-24292 | Medium | 6.8 | 2025-06-29 | A misconfigured query in UniFi Network (v9.1.120 and earlier) could allow users to authenticate to Enterprise WiFi or VPN Server (l2tp and OpenVPN) using a dev… |
CVE-2025-52553 | Critical | 9.6 | 2025-06-27 | authentik is an open-source identity provider. After authorizing access to a RAC endpoint, authentik creates a token which is used for a single connection and… |
CVE-2025-6763 | High | 8.1 | 2025-06-27 | A vulnerability was found in Comet System T0510, T3510, T3511, T4511, T6640, T7511, T7611, P8510, P8552 and H3531 1.60. Affected by this issue is some unknown… |
CVE-2025-53013 | Medium | 5.2 | 2025-06-26 | Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. A vulnerability present in versions 0.9.10 through 0.9.16 allows a user to aut… |
CVE-2024-6174 | High | 8.8 | 2025-06-26 | When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configuratio… |
CVE-2025-52572 | Critical | 10.0 | 2025-06-24 | Hikka, a Telegram userbot, has vulnerability affects all users on all versions of Hikka. Two scenarios are possible. 1. Web interface does not have an authenti… |
CVE-2025-52571 | Critical | 9.6 | 2025-06-24 | Hikka is a Telegram userbot. A vulnerability affects all users of versions below 1.6.2, including most of the forks. It allows an unauthenticated attacker to g… |
CVE-2025-49851 | Critical | 9.8 | 2025-06-24 | ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to an improper authentication vulnerability which could allow an attacker to bypass a… |
CVE-2025-32975 | Critical | 10.0 | 2025-06-24 | Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1… |
CVE-2025-6533 | Medium | 5.6 | 2025-06-24 | A vulnerability, which was classified as critical, has been found in xxyopen/201206030 novel-plus up to 5.1.3. Affected by this issue is the function ajaxLogin… |
CVE-2025-6528 | Medium | 4.3 | 2025-06-23 | A vulnerability has been found in 70mai M300 up to 20250611 and classified as problematic. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2025-6524 | Low | 3.1 | 2025-06-23 | A vulnerability classified as problematic has been found in 70mai 1S up to 20250611. This affects an unknown part of the component Video Services. The manipula… |
CVE-2024-45347 | Critical | 9.6 | 2025-06-23 | An unauthorized access vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be expl… |
CVE-2025-32879 | High | 8.8 | 2025-06-20 | An issue was discovered on COROS PACE 3 devices through 3.0808.0. It starts advertising if no device is connected via Bluetooth. This allows an attacker to con… |
CVE-2025-32877 | Critical | 9.8 | 2025-06-20 | An issue was discovered on COROS PACE 3 devices through 3.0808.0. It identifies itself as a device without input or output capabilities, which results in the u… |
CVE-2025-32875 | Medium | 5.7 | 2025-06-20 | An issue was discovered in the COROS application through 3.8.12 for Android. Bluetooth pairing and bonding is neither initiated nor enforced by the application… |
CVE-2025-49591 | Critical | 9.1 | 2025-06-18 | CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) in CryptPad can be trivially bypassed, due to weak… |