CWE-306 · Missing Authentication for Critical Function (page 14)
Page 14 of 30 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-30039 | | 2025-08-27 | Unauthenticated access to the "/cgi-bin/CliniNET.prd/GetActiveSessions.pl" endpoint allows takeover of any user session logged into the system, including users… | |
CVE-2025-30037 | | 2025-08-27 | The system exposes several endpoints, typically including "/int/" in their path, that should be restricted to internal services, but are instead publicly acces… | |
CVE-2025-25736 | Medium | 6.8 | 2025-08-26 | Kapsch TrafficCom RIS-9260 RSU LEO v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to contain Android Debug Bridge (ADB) pre-installed (/mnt/… |
CVE-2025-8627 | High | 8.8 | 2025-08-25 | The TP-Link KP303 Smartplug can be issued unauthenticated protocol commands that may cause unintended power-off condition and potential information leak. This… |
CVE-2025-53118 | Critical | 9.8 | 2025-08-25 | An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to compromise of pass… |
CVE-2022-43110 | Critical | 9.8 | 2025-08-22 | Voltronic Power ViewPower through 1.04-21353 and PowerShield Netguard before 1.04-23292 allows a remote attacker to configure the system via an unspecified web… |
CVE-2025-55581 | High | 7.3 | 2025-08-22 | D-Link DCS-825L firmware version 1.08.01 and possibly prior versions contain an insecure implementation in the mydlink-watch-dog.sh script. The script monitors… |
CVE-2025-9254 | Critical | 9.8 | 2025-08-22 | WebITR developed by Uniong has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to log into the system as arbitrary users by e… |
CVE-2024-45438 | Critical | 9.1 | 2025-08-21 | An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14. The file quarantine.php within the SpamTi… |
CVE-2025-47870 | Medium | 4.3 | 2025-08-21 | Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fail to sanitize the team invite ID in the POST /api/v4/teams/:tea… |
CVE-2025-27214 | Critical | 9.8 | 2025-08-21 | A Missing Authentication for Critical Function vulnerability in the UniFi Connect EV Station Pro may allow a malicious actor with physical or adjacent access t… |
CVE-2025-8611 | Critical | 9.8 | 2025-08-20 | AOMEI Cyber Backup Missing Authentication for Critical Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi… |
CVE-2025-8610 | Critical | 9.8 | 2025-08-20 | AOMEI Cyber Backup Missing Authentication for Critical Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi… |
CVE-2025-51543 | Critical | 9.8 | 2025-08-19 | An issue was discovered in Cicool builder 3.4.4 allowing attackers to reset the administrator's password via the /administrator/auth/reset_password endpoint. |
CVE-2025-8450 | High | 8.2 | 2025-08-19 | Improper Access Control issue in the Workflow component of Fortra's FileCatalyst allows unauthenticated users to upload arbitrary files via the order forms pag… |
CVE-2025-41689 | High | 7.5 | 2025-08-19 | An unauthenticated remote attacker can get access without password protection to the affected device. This enables the unprotected read-only access to the stor… |
CVE-2025-8995 | Critical | 9.8 | 2025-08-15 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authentica… |
CVE-2025-43983 | Critical | 9.1 | 2025-08-14 | KuWFi CPF908-CP5 WEB5.0_LCD_20210125 devices have multiple unauthenticated access control vulnerabilities within goform/goform_set_cmd_process and goform/gofor… |
CVE-2025-7774 | | 2025-08-14 | A security issue exists within the 5032 16pt Digital Configurable module’s web server. Intercepted session credentials can be used within a 3-minute timeout wi… | |
CVE-2025-8943 | Critical | 9.8 | 2025-08-14 | The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent auth… |
CVE-2011-10013 | | 2025-08-13 | Traq versions 2.0 through 2.3 contain a remote code execution vulnerability in the admincp/common.php script. The flawed authorization logic fails to halt exec… | |
CVE-2025-8754 | High | 7.5 | 2025-08-13 | Missing Authentication for Critical Function vulnerability in ABB ABB AbilityTM zenon.This issue affects ABB AbilityTM zenon: from 7.50 through 14. |
CVE-2025-53789 | High | 7.8 | 2025-08-12 | Missing authentication for critical function in Windows StateRepository API allows an authorized attacker to elevate privileges locally. |
CVE-2025-54864 | High | 7.5 | 2025-08-12 | Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding… |
CVE-2025-41686 | High | 7.8 | 2025-08-12 | A low-privileged local attacker can exploit improper permissions on nssm.exe to escalate their privileges and gain administrative access. |
CVE-2025-7679 | High | 8.1 | 2025-08-11 | The ASPECT system allows users to bypass authentication. This issue affects all versions of ASPECT |
CVE-2025-54478 | High | 7.2 | 2025-08-11 | Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticated attackers to ed… |
CVE-2025-44004 | High | 7.2 | 2025-08-11 | Mattermost Confluence Plugin version <1.5.0 fails to check the authorization of the user to the Mattermost instance which allows attackers to create a channel… |
CVE-2025-5095 | Critical | 9.8 | 2025-08-08 | Burk Technology ARC Solo's password change mechanism can be utilized without proper authentication procedures, allowing an attacker to take over the device. … |
CVE-2025-8284 | Critical | 9.8 | 2025-08-08 | By default, the Packet Power Monitoring and Control Web Interface do not enforce authentication mechanisms. This vulnerability could allow unauthorized users… |
CVE-2014-125113 | | 2025-08-05 | An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance version 5.0 - 5.3, 5.4 prior to 5.4.76849… | |
CVE-2012-10030 | Critical | 9.8 | 2025-08-05 | FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbitrary files to sensitive system director… |
CVE-2025-20702 | High | 8.8 | 2025-08-04 | In the Airoha Bluetooth audio SDK, there is a possible unauthorized access to the RACE protocol. This could lead to remote escalation of privilege with no addi… |
CVE-2025-20700 | High | 8.8 | 2025-08-04 | In the Airoha Bluetooth audio SDK, there is a possible permission bypass that allows access critical data of RACE protocol through Bluetooth LE GATT service. T… |
CVE-2013-10046 | | 2025-08-01 | A local privilege escalation vulnerability exists in Agnitum Outpost Internet Security 8.1 that allows an unprivileged user to execute arbitrary code with SYST… | |
CVE-2025-8286 | | 2025-07-31 | The affected products expose an unauthenticated Telnet-based command line interface that could allow an attacker to modify hardware configurations, manipulate… | |
CVE-2014-125126 | | 2025-07-31 | An unrestricted file upload vulnerability exists in Simple E-Document versions 3.0 to 3.1 that allows an unauthenticated attacker to bypass authentication by s… | |
CVE-2014-125124 | | 2025-07-31 | An unauthenticated remote command execution vulnerability exists in Pandora FMS versions up to and including 5.0RC1 via the Anyterm web interface, which listen… | |
CVE-2025-8279 | High | 8.7 | 2025-07-28 | Insufficient input validation within GitLab Language Server 7.6.0 and later before 7.30.0 allows arbitrary GraphQL query execution |
CVE-2025-30126 | Medium | 5.3 | 2025-07-28 | An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. Via port 7777 without any need to pair or press a physical button, a remote attacker can dis… |
CVE-2025-30135 | Critical | 9.4 | 2025-07-25 | An issue was discovered on IROAD Dashcam FX2 devices. Dumping Files Over HTTP and RTSP Without Authentication can occur. It lacks authentication controls on it… |
CVE-2016-15046 | | 2025-07-25 | A client-side remote code execution vulnerability exists in Hanwha Techwin Smart Security Manager (SSM) versions 1.32 and 1.4, due to improper restrictions on… | |
CVE-2014-125118 | | 2025-07-25 | A command injection vulnerability exists in the eScan Web Management Console version 5.5-2. The application fails to properly sanitize the 'pass' parameter whe… | |
CVE-2014-125116 | | 2025-07-25 | A remote code execution vulnerability exists in HybridAuth versions 2.0.9 through 2.2.2 due to insecure use of the install.php installation script. The script… | |
CVE-2013-10032 | High | 8.8 | 2025-07-25 | An authenticated remote code execution vulnerability exists in GetSimpleCMS version 3.2.1. The application’s upload.php endpoint allows authenticated users to… |
CVE-2025-6260 | Critical | 9.8 | 2025-07-24 | The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the local area network… |
CVE-2022-4978 | | 2025-07-23 | Remote Control Server, maintained by Steppschuh, 3.1.1.12 allows unauthenticated remote code execution when authentication is disabled, which is the default co… | |
CVE-2016-15045 | | 2025-07-23 | A local privilege escalation vulnerability exists in lastore-daemon, the system package manager daemon used in Deepin Linux (developed by Wuhan Deepin Technolo… | |
CVE-2015-10141 | | 2025-07-23 | An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. W… | |
CVE-2025-48733 | High | 7.5 | 2025-07-22 | DuraComm SPM-500 DP-10iN-100-MU lacks access controls for a function that should require user authentication. This could allow an attacker to repeatedly rebo… |
CVE-2025-7897 | High | 7.3 | 2025-07-20 | A vulnerability was found in harry0703 MoneyPrinterTurbo up to 1.2.6 and classified as critical. Affected by this issue is the function verify_token of the fil… |
CVE-2025-7862 | High | 7.3 | 2025-07-20 | A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setTelnetCfg of… |
CVE-2025-6226 | Medium | 6.5 | 2025-07-18 | Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by Pendin… |
CVE-2025-34130 | | 2025-07-16 | An unauthenticated arbitrary file read exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the /z/zbin/net_html… | |
CVE-2025-34121 | | 2025-07-16 | An unauthenticated arbitrary file upload vulnerability exists in Idera Up.Time Monitoring Station versions up to and including 7.2. The `wizards/post2file.php`… | |
CVE-2025-34120 | | 2025-07-16 | An unauthenticated file download vulnerability exists in LimeSurvey versions from 2.0+ up to and including 2.06+ Build 151014. The application fails to validat… | |
CVE-2025-34119 | | 2025-07-16 | A remote file disclosure vulnerability exists in EasyCafe Server 2.2.14, exploitable by unauthenticated remote attackers via TCP port 831. The server listens f… | |
CVE-2025-34117 | | 2025-07-16 | A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an… | |
CVE-2025-53938 | High | 7.5 | 2025-07-16 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. An Authentication Bypass vulnerability was identified… |
CVE-2025-30762 | High | 7.5 | 2025-07-15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1… |
CVE-2025-34116 | | 2025-07-15 | A remote command execution vulnerability exists in IPFire before version 2.19 Core Update 101 via the 'proxy.cgi' CGI interface. An authenticated attacker can… | |
CVE-2025-34115 | | 2025-07-15 | An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 via the 'cmd_str' parameter in the command_test.php endpoint. A us… | |
CVE-2025-34113 | | 2025-07-15 | An authenticated command injection vulnerability exists in Tiki Wiki CMS versions ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14 via the `viewmode` GET parameter in `t… | |
CVE-2025-34112 | | 2025-07-15 | An authenticated multi-stage remote code execution vulnerability exists in Riverbed SteelCentral NetProfiler and NetExpress 10.8.7 virtual appliances. A SQL in… | |
CVE-2025-34111 | Critical | 9.8 | 2025-07-15 | An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder component's default connecto… |
CVE-2025-34110 | | 2025-07-15 | A directory traversal vulnerability exists in ColoradoFTP Server ≤ 1.3 Build 8 for Windows, allowing unauthenticated attackers to read or write arbitrary files… | |
CVE-2025-34104 | | 2025-07-15 | An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism. In vulnerable versio… | |
CVE-2025-34103 | | 2025-07-15 | An unauthenticated command injection vulnerability exists in WePresent WiPG-1000 firmware versions prior to 2.2.3.0, due to improper input handling in the undo… | |
CVE-2025-34068 | | 2025-07-15 | An unauthenticated remote command execution vulnerability exists in Samsung WLAN AP WEA453e firmware prior to version 5.2.4.T1 via improper input validation in… | |
CVE-2025-52089 | High | 8.8 | 2025-07-11 | A hidden remote support feature protected by a static secret in TOTOLINK N300RB firmware version 8.54 allows an authenticated attacker to execute arbitrary OS… |
CVE-2025-34102 | | 2025-07-10 | A remote code execution vulnerability exists in CryptoLog (PHP version, discontinued since 2009) due to a chained exploitation of SQL injection and command inj… | |
CVE-2025-34101 | | 2025-07-10 | An unauthenticated command injection vulnerability exists in Serviio Media Server versions 1.4 through 1.8 on Windows, in the /rest/action API endpoint exposed… | |
CVE-2025-34100 | | 2025-07-10 | An unrestricted file upload vulnerability exists in BuilderEngine 3.5.0 via the integration of the elFinder 2.0 file manager and its use of the jQuery File Upl… | |
CVE-2025-53378 | High | 7.6 | 2025-07-10 | A missing authentication vulnerability in Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an unauthenticated attacker to rem… |
CVE-2025-3498 | Critical | 9.9 | 2025-07-09 | An unauthenticated user with management network access can get and modify the Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) configuration. The device… |
CVE-2025-34077 | | 2025-07-09 | An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary use… | |
CVE-2025-7031 | Medium | 5.3 | 2025-07-08 | Missing Authentication for Critical Function vulnerability in Drupal Config Pages Viewer allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-48814 | High | 7.5 | 2025-07-08 | Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an unauthorized attacker to bypass a security feature over a ne… |
CVE-2025-40736 | Critical | 9.8 | 2025-07-08 | A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application exposes an endpoint that allows an unauthorized modification o… |
CVE-2025-25268 | High | 8.8 | 2025-07-08 | An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due to missing… |
CVE-2025-7115 | High | 7.3 | 2025-07-07 | A vulnerability was found in rowboatlabs rowboat up to 8096eaf63b5a0732edd8f812bee05b78e214ee97. It has been rated as critical. Affected by this issue is the f… |
CVE-2025-7114 | High | 7.3 | 2025-07-07 | A vulnerability was found in SimStudioAI sim up to 37786d371e17d35e0764e1b5cd519d873d90d97b. It has been declared as critical. Affected by this vulnerability i… |
CVE-2025-34089 | | 2025-07-03 | An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility developed by Aexol Studio, in versions up to an… | |
CVE-2025-34079 | High | 7.8 | 2025-07-02 | An authenticated remote code execution vulnerability exists in NSClient++ version 0.5.2.35 when the web interface and ExternalScripts module are enabled. A rem… |
CVE-2025-45814 | Critical | 9.8 | 2025-07-02 | Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 v7.02.08 allows attackers to execute a s… |
CVE-2025-34073 | | 2025-07-02 | An unauthenticated command injection vulnerability exists in stamparm/maltrail (Maltrail) versions <=0.54. A remote attacker can execute arbitrary operating sy… | |
CVE-2025-34071 | Critical | 9.8 | 2025-07-02 | A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload and execute arbitrary code through the f… |
CVE-2025-34070 | Critical | 9.8 | 2025-07-02 | A missing authentication vulnerability in the GFIAgent component of GFI Kerio Control 9.4.5 allows unauthenticated remote attackers to perform privileged opera… |
CVE-2025-34069 | Critical | 9.8 | 2025-07-02 | An authentication bypass vulnerability exists in GFI Kerio Control 9.4.5 due to insecure default proxy configuration and weak access control in the GFIAgent se… |
CVE-2025-34057 | | 2025-07-02 | An information disclosure vulnerability exists in Ruijie NBR series routers (known to affect NBR2000G, NBR1300G, and NBR1000 models) via the /WEB_VMS/LEVEL15/… | |
CVE-2025-6920 | Medium | 5.3 | 2025-07-01 | A flaw was found in the authentication enforcement mechanism of a model inference API in ai-inference-server. All /v1/* endpoints are expected to enforce API k… |
CVE-2025-41656 | Critical | 10.0 | 2025-07-01 | An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the Node_RED server i… |
CVE-2025-6916 | High | 8.8 | 2025-06-30 | A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. This affects the function Form_Login of the file /formLoginA… |
CVE-2024-8419 | High | 7.5 | 2025-06-30 | The endpoint hosts a script that allows an unauthorized remote attacker to put the system in a fail-safe state over the network due to missing authentication. |
CVE-2025-5310 | Critical | 9.8 | 2025-06-27 | Dover Fueling Solutions ProGauge MagLink LX Consoles expose an undocumented and unauthenticated target communication framework (TCF) interface on a specific po… |
CVE-2025-6763 | High | 8.1 | 2025-06-27 | A vulnerability was found in Comet System T0510, T3510, T3511, T4511, T6640, T7511, T7611, P8510, P8552 and H3531 1.60. Affected by this issue is some unknown… |
CVE-2025-3699 | Critical | 9.8 | 2025-06-26 | Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation G-50 all versions, G-50-W all versions, G-50A all versions, GB-50… |
CVE-2025-1754 | Medium | 5.3 | 2025-06-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowe… |
CVE-2025-6678 | High | 7.5 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose… |
CVE-2025-32978 | High | 7.5 | 2025-06-24 | Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1… |