CWE-862 · Missing Authorization (page 31)
Page 31 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-62867 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in ergonet Ergonet Cache ergonet-varnish-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-62865 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in Evan Herman Post Cloner post-cloner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-62740 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-62738 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in mmattax Formstack Online Forms formstack allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-62736 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in opicron Image Cleanup image-cleanup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-62153 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in Graham Quick Interest Slider quick-interest-slider allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-62152 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in ConveyThis ConveyThis conveythis-translate allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-62151 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in Virtuaria Virtuaria PagBank / PagSeguro para Woocommerce virtuaria-pagseguro allows Exploiting Incorrectly Configured Ac… |
CVE-2025-62100 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in themerain ThemeRain Core themerain-core allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2025-62090 | Medium | 6.5 | 2025-12-09 | Missing Authorization vulnerability in Jegstudio Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons gutenverse-news allows Exploiting Incorr… |
CVE-2025-62086 | Medium | 5.4 | 2025-12-09 | Missing Authorization vulnerability in akazanstev Яндекс Доставка (Boxberry) boxberry allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-62085 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in Bertha AI – Andrew Palmer BERTHA AI bertha-ai-free allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-49350 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in marcoingraiti Actionwear products sync actionwear-products-sync allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-49348 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in Hype Hype pico allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hype: from n/a… |
CVE-2025-42891 | Medium | 5.5 | 2025-12-09 | Due to a missing authorization check in SAP Enterprise Search for ABAP, an attacker with high privileges may read and export the contents of database tables in… |
CVE-2025-48608 | Medium | 5.5 | 2025-12-08 | In isValidMediaUri of SettingsProvider.java, there is a possible cross user media read due to a missing permission check. This could lead to local information… |
CVE-2025-48614 | Medium | 4.6 | 2025-12-08 | In rebootWipeUserData of RecoverySystem.java, there is a possible way to factory reset the device while in DSU mode due to a missing permission check. This cou… |
CVE-2025-48604 | Medium | 5.5 | 2025-12-08 | In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosu… |
CVE-2025-48600 | Medium | 5.5 | 2025-12-08 | In multiple files, there is a possible way to reveal information across users due to a missing permission check. This could lead to local information disclosur… |
CVE-2025-48599 | High | 7.8 | 2025-12-08 | In multiple functions of WifiScanModeActivity.java, there is a possible way to bypass a device config restriction due to a missing permission check. This could… |
CVE-2025-48591 | Medium | 5.5 | 2025-12-08 | In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosu… |
CVE-2025-48575 | High | 7.8 | 2025-12-08 | In multiple functions of CertInstaller.java, there is a possible way to install certificates due to a permissions bypass. This could lead to local escalation o… |
CVE-2025-32319 | Medium | 6.7 | 2025-12-08 | In ensureBound of RemotePrintService.java, there is a possible way for a background app to keep foreground permissions due to a permissions bypass. This could… |
CVE-2025-14117 | Medium | 4.3 | 2025-12-06 | A vulnerability has been found in fit2cloud Halo 2.21.10. Impacted is an unknown function. The manipulation leads to cross-site request forgery. The attack may… |
CVE-2025-13666 | Medium | 5.3 | 2025-12-06 | The Helloprint plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.2. This is due to the plugin registering a pub… |
CVE-2025-13358 | Medium | 5.3 | 2025-12-06 | The Accessiy By CodeConfig Accessibility plugin for WordPress is vulnerable to unauthorized page creation due to missing authorization checks in versions up to… |
CVE-2025-13309 | Medium | 4.3 | 2025-12-06 | The Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters plugin for WordPress is vulnerable to authorization bypass i… |
CVE-2025-12721 | Medium | 5.3 | 2025-12-06 | The g-FFL Cockpit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1 via the /server_status REST… |
CVE-2025-12577 | Medium | 4.3 | 2025-12-06 | The Listar – Directory Listing & Classifieds WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabili… |
CVE-2025-12574 | Medium | 4.3 | 2025-12-06 | The Listar – Directory Listing & Classifieds WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check… |
CVE-2025-12091 | Medium | 4.3 | 2025-12-06 | The Search, Filters & Merchandising for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2025-65036 | High | 8.3 | 2025-12-05 | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from t… |
CVE-2025-13620 | Medium | 5.3 | 2025-12-05 | The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to missing authorization in versions up to, and including, 3.1.3. This is du… |
CVE-2025-12876 | Medium | 5.3 | 2025-12-05 | The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2025-12355 | Medium | 5.3 | 2025-12-05 | The Payaza plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_nopriv_update_order_status… |
CVE-2025-12354 | Medium | 4.3 | 2025-12-05 | The Live CSS Preview plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_frontend_save' A… |
CVE-2025-12093 | Medium | 5.3 | 2025-12-05 | The Voidek Employee Portal plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX actions in all versions… |
CVE-2025-13528 | Medium | 5.3 | 2025-12-05 | The Feedback Modal for Website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_export' funct… |
CVE-2025-12370 | Medium | 4.3 | 2025-12-05 | The Takeads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.13. This is due to the plugin not properly ver… |
CVE-2025-12165 | Medium | 4.3 | 2025-12-05 | The Webcake – Landing Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'webcake_sa… |
CVE-2025-12133 | Medium | 4.3 | 2025-12-05 | The EPROLO Dropshipping plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wp_ajax_eprolo_delete_… |
CVE-2025-13313 | Critical | 9.8 | 2025-12-05 | The CRM Memberships plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 2.6. This is due to mis… |
CVE-2025-13312 | Medium | 5.3 | 2025-12-05 | The CRM Memberships plugin for WordPress is vulnerable to unauthorized membership tag creation due to a missing capability check on the 'ntzcrm_add_new_tag' fu… |
CVE-2025-54159 | High | 7.5 | 2025-12-04 | Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows remote attackers to delete arbitrary files via unspe… |
CVE-2025-2848 | Medium | 6.3 | 2025-12-04 | A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive settings, and disable some non-critical functions. |
CVE-2025-12826 | Medium | 4.8 | 2025-12-04 | The Custom Post Type UI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.18.0. This is due to the plugin not… |
CVE-2025-12782 | Medium | 4.3 | 2025-12-04 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.9.4. This is due… |
CVE-2025-13756 | Medium | 4.3 | 2025-12-03 | The Fluent Booking plugin for WordPress is vulnerable to unauthorized calendar import and management due to a missing capability check on the "importCalendar"… |
CVE-2025-13354 | Medium | 4.3 | 2025-12-03 | The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and inclu… |
CVE-2025-13342 | Critical | 9.8 | 2025-12-03 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and incl… |
CVE-2025-12887 | Medium | 5.4 | 2025-12-03 | The Post SMTP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.1. This is due to the plugin not properly ve… |
CVE-2025-13472 | | 2025-12-03 | A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential ID… | |
CVE-2025-10304 | Medium | 5.3 | 2025-12-03 | The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing cap… |
CVE-2025-13828 | | 2025-12-02 | SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for ena… | |
CVE-2025-41012 | Medium | 5.3 | 2025-12-02 | Unauthorized access vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists o… |
CVE-2025-11726 | Medium | 4.3 | 2025-12-02 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.9.4. This is du… |
CVE-2025-13813 | Medium | 5.6 | 2025-12-01 | A vulnerability was identified in moxi159753 Mogu Blog v2 up to 5.2. This issue affects some unknown processing of the file /storage/ of the component Storage… |
CVE-2025-13790 | Medium | 4.3 | 2025-11-30 | A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function. This manipulation causes cross-site request forgery. The attack ma… |
CVE-2025-65112 | Critical | 9.4 | 2025-11-29 | PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to uplo… |
CVE-2025-10476 | Medium | 4.3 | 2025-11-27 | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpfc_db_fix_callback() fu… |
CVE-2025-13381 | Medium | 5.3 | 2025-11-27 | The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'ay… |
CVE-2025-13441 | Medium | 5.3 | 2025-11-27 | The Hide Category by User Role for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.1. This is… |
CVE-2025-12579 | Medium | 5.3 | 2025-11-27 | The Reuters Direct plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'logoff' action in all vers… |
CVE-2025-65669 | Critical | 9.1 | 2025-11-26 | An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page without any authorization or authentication ch… |
CVE-2025-55471 | High | 7.5 | 2025-11-26 | Incorrect access control in the getUserFormData function of youlai-boot v2.21.1 allows attackers to access sensitive information for other users. |
CVE-2025-46175 | High | 7.5 | 2025-11-26 | Ruoyi v4.8.0 is vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the authRole method of SysUserController.java. |
CVE-2025-46174 | High | 7.5 | 2025-11-26 | Ruoyi v4.8.0 vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the resetPwd Method of SysUserController.java. |
CVE-2025-12061 | High | 8.6 | 2025-11-26 | The TAX SERVICE Electronic HDM WordPress plugin before 1.2.1 does not authorization and CSRF checks in an AJAX action, allowing unauthenticated users to import… |
CVE-2025-66022 | Critical | 9.6 | 2025-11-26 | FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction’s extension framework per… |
CVE-2025-13414 | Medium | 5.3 | 2025-11-25 | The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to unauthorized data export due to a missing capability check on the cdash_watch_fo… |
CVE-2025-13405 | Medium | 5.3 | 2025-11-25 | The Ace Post Type Builder plugin for WordPress is vulnerable to unauthorized custom taxonomy deletion due to missing authorization validation on the cptb_delet… |
CVE-2025-13404 | Medium | 5.3 | 2025-11-25 | The atec Duplicate Page & Post plugin for WordPress is vulnerable to unauthorized post duplication due to missing authorization validation on the duplicate_pos… |
CVE-2025-13386 | Medium | 5.3 | 2025-11-25 | The Social Images Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'options_update' func… |
CVE-2025-12634 | Medium | 4.3 | 2025-11-25 | The Refund Request for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_ref… |
CVE-2025-12043 | Medium | 5.3 | 2025-11-25 | The Autochat Automatic Conversation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_n… |
CVE-2025-13643 | Low | 3.1 | 2025-11-25 | A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are being executed by other users. This may cau… |
CVE-2025-13558 | Medium | 5.4 | 2025-11-25 | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2025-10646 | Medium | 4.3 | 2025-11-25 | The Search Exclude plugin for WordPress is vulnerable to unauthorized modification of data due to a insufficient capability check on the Base::get_rest_permiss… |
CVE-2025-41017 | | 2025-11-24 | Inadequate access control vulnerability in Davantis DDFUSION v6.177.7, which allows unauthorised actors to retrieve perspective parameters from security camera… | |
CVE-2025-41016 | | 2025-11-24 | Inadequate access control vulnerability in Davantis DFUSION v6.177.7, which allows unauthorised actors to extract images and videos related to alarm events thr… | |
CVE-2025-13318 | Medium | 5.3 | 2025-11-22 | The Booking Calendar Contact Form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.60. This is due to miss… |
CVE-2025-13136 | Medium | 4.3 | 2025-11-22 | The GSheetConnector For Ninja Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'njform-google-s… |
CVE-2025-13384 | High | 7.5 | 2025-11-22 | The CP Contact Form with PayPal plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.56. This is due to the pl… |
CVE-2025-13317 | Medium | 5.3 | 2025-11-22 | The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.96. This is due to the p… |
CVE-2025-12877 | Medium | 5.3 | 2025-11-22 | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized modification od data due to a missing capa… |
CVE-2025-66114 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in theme funda Show Variations as Single Products Woocommerce woo-show-single-variations-shop-category allows Exploiting In… |
CVE-2025-66113 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in ThemeAtelier Better Chat Support for Messenger better-chat-support allows Exploiting Incorrectly Configured Access Contr… |
CVE-2025-66112 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in WebToffee Accessibility Toolkit by WebYes accessibility-plus allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-66110 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-66109 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in Octolize Shipping Plugins Cart Weight for WooCommerce woo-cart-weight allows Exploiting Incorrectly Configured Access Co… |
CVE-2025-66108 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Merlot Digital (by TNC) TNC Toolbox: Web Performance tnc-toolbox allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-66107 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in Scott Paterson Subscriptions & Memberships for PayPal subscriptions-memberships-for-paypal allows Exploiting Incorrectly… |
CVE-2025-66106 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Essential Plugin Featured Post Creative featured-post-creative allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-66101 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Sabuj Kundu CBX Bookmark & Favorite cbxwpbookmark allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-66099 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in ThemeAtelier Chat Help chat-help allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-66096 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Imtiaz Rayhan Table Block by Tableberg tableberg allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66089 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-66087 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Property Hive PropertyHive propertyhive allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2025-66086 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-66085 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Exploiting Incorrectly Configured Access Control Security Le… |