CWE-862 · Missing Authorization (page 32)
Page 32 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-66084 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Shahjahan Jewel FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66083 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-66082 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-66079 | Medium | 6.5 | 2025-11-21 | Missing Authorization vulnerability in Jegstudio Gutenverse Form gutenverse-form allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-66077 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-66075 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Conf… |
CVE-2025-66072 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Users… |
CVE-2025-66071 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in tychesoftwares Custom Order Numbers for WooCommerce custom-order-numbers-for-woocommerce allows Exploiting Incorrectly C… |
CVE-2025-66069 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Themeisle PPOM for WooCommerce woocommerce-product-addon allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-66065 | Medium | 6.5 | 2025-11-21 | Missing Authorization vulnerability in Jegstudio Gutenverse gutenverse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-66063 | Medium | 5.4 | 2025-11-21 | Missing Authorization vulnerability in jgwhite33 WP Google Review Slider wp-google-places-review-slider allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-66060 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-10054 | Medium | 4.3 | 2025-11-21 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-13149 | Medium | 4.3 | 2025-11-21 | The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthoriz… |
CVE-2025-12170 | Medium | 5.3 | 2025-11-21 | The Checkbox plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wp_ajax_nopriv_checkbox_clean_log' AJAX… |
CVE-2025-11985 | High | 8.8 | 2025-11-21 | The Realty Portal plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability che… |
CVE-2025-11773 | Medium | 4.3 | 2025-11-21 | The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthorized modification of data due to… |
CVE-2025-11003 | Medium | 6.4 | 2025-11-21 | The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missin… |
CVE-2025-10938 | Medium | 6.5 | 2025-11-21 | The UiPress lite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.08. This is due to missing capa… |
CVE-2025-9825 | Medium | 5.0 | 2025-11-21 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 to 18.2.8, 18.3 before 18.3.4, and 18.4 before 18.4.2 that could have allowed a… |
CVE-2025-12169 | Medium | 4.3 | 2025-11-21 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-12085 | Medium | 4.3 | 2025-11-21 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-12023 | Medium | 4.3 | 2025-11-21 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-12022 | Medium | 4.3 | 2025-11-21 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-52670 | Medium | 6.5 | 2025-11-20 | Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by other accounts |
CVE-2025-62293 | Medium | 5.4 | 2025-11-20 | SOPlanning is vulnerable to Broken Access Control in /status endpoint. Due to lack of permission checks in Project Status functionality an authenticated attack… |
CVE-2025-13468 | Medium | 5.4 | 2025-11-20 | A weakness has been identified in SourceCodester Alumni Management System 1.0. This issue affects the function delete_forum/delete_career/delete_comment/delete… |
CVE-2025-12778 | Medium | 5.3 | 2025-11-20 | The Ultimate Member Widgets for Elementor – WordPress User Directory plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabil… |
CVE-2025-65089 | Medium | 6.8 | 2025-11-19 | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to version 1.27.0, a user with no view rights… |
CVE-2025-65029 | High | 8.1 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authent… |
CVE-2025-65028 | Medium | 6.5 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authent… |
CVE-2025-65021 | Critical | 9.1 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability exists in the poll… |
CVE-2025-65020 | Medium | 6.5 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability in the poll duplic… |
CVE-2025-12822 | Medium | 4.3 | 2025-11-19 | The WP Login and Register using JWT plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mo_jwt_generate… |
CVE-2025-12751 | Medium | 4.3 | 2025-11-19 | The WSChat – WordPress Live Chat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'reset_settin… |
CVE-2025-12174 | Medium | 6.5 | 2025-11-19 | The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access due to a missing c… |
CVE-2025-12955 | High | 7.5 | 2025-11-18 | The Live sales notification for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.39. This is d… |
CVE-2025-12639 | Medium | 4.3 | 2025-11-18 | The wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions plugin for WordPress is vulnerable to authorization bypass in versions up to, and includ… |
CVE-2025-12481 | Medium | 4.3 | 2025-11-18 | The WP Duplicate Page plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.7. This is due to the plugin not prop… |
CVE-2025-12392 | Medium | 5.3 | 2025-11-18 | The Cryptocurrency Payment Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on… |
CVE-2025-12391 | Medium | 5.3 | 2025-11-18 | The Restrictions for BuddyPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_optin_o… |
CVE-2025-11734 | Medium | 5.4 | 2025-11-18 | The Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links plugin for WordPress is vulnerable to unauthorized post modification due to… |
CVE-2025-12961 | Medium | 4.3 | 2025-11-18 | The Download Panel plugin for WordPress is vulnerable to unauthorized settings modification due to a missing capability check on the 'wp_ajax_save_settings' AJ… |
CVE-2025-12937 | Medium | 6.5 | 2025-11-18 | The ACF Flexible Layouts Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'acf_flm_upda… |
CVE-2025-12372 | Medium | 4.3 | 2025-11-18 | The Permalinks Cascade plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.2. This is due to the plugin not pro… |
CVE-2025-11620 | High | 7.2 | 2025-11-18 | The Multiple Roles per User plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mrpu_add_multiple… |
CVE-2025-6171 | Medium | 5.3 | 2025-11-15 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allow… |
CVE-2025-12849 | Medium | 5.3 | 2025-11-15 | The Contest Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 28.0.2. This is due to the plugin register… |
CVE-2025-12847 | Medium | 4.3 | 2025-11-15 | The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized arbitrary media attachment… |
CVE-2025-13179 | Medium | 4.3 | 2025-11-14 | A vulnerability has been found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320. This issue affects some unknown… |
CVE-2025-13177 | Medium | 4.3 | 2025-11-14 | A vulnerability was detected in Bdtask/CodeCanyon SalesERP up to 20250728. This affects an unknown part. The manipulation results in cross-site request forgery… |
CVE-2025-13119 | Medium | 4.3 | 2025-11-13 | A flaw has been found in Fabian Ros/SourceCodester Simple E-Banking System 1.0. This affects an unknown part. This manipulation causes cross-site request forge… |
CVE-2025-12817 | Low | 3.1 | 2025-11-13 | Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creati… |
CVE-2025-12377 | Medium | 4.3 | 2025-11-13 | The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-64384 | Medium | 5.3 | 2025-11-13 | Missing Authorization vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-64382 | Medium | 4.3 | 2025-11-13 | Missing Authorization vulnerability in WebToffee Order Export & Order Import for WooCommerce order-import-export-for-woocommerce allows Exploiting Incorrectly… |
CVE-2025-64379 | Medium | 4.3 | 2025-11-13 | Missing Authorization vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-64370 | Medium | 5.3 | 2025-11-13 | Missing Authorization vulnerability in YOP YOP Poll yop-poll allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YOP Pol… |
CVE-2025-64369 | Medium | 6.5 | 2025-11-13 | Missing Authorization vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-64277 | Medium | 5.3 | 2025-11-13 | Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-64276 | Medium | 6.5 | 2025-11-13 | Missing Authorization vulnerability in Ays Pro Survey Maker survey-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-64274 | Medium | 4.3 | 2025-11-13 | Missing Authorization vulnerability in wpkoithemes WPKoi Templates for Elementor wpkoi-templates-for-elementor allows Exploiting Incorrectly Configured Access… |
CVE-2025-64269 | Medium | 4.3 | 2025-11-13 | Missing Authorization vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Exploiting Incorrectly Configured Access Contr… |
CVE-2025-64265 | Medium | 4.3 | 2025-11-13 | Missing Authorization vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-64263 | Medium | 5.4 | 2025-11-13 | Missing Authorization vulnerability in PluginEver WP Content Pilot wp-content-pilot allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-64261 | Medium | 5.4 | 2025-11-13 | Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-64259 | Medium | 5.3 | 2025-11-13 | Missing Authorization vulnerability in Jeroen Schmit Theater for WordPress theatre allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-12015 | Medium | 4.3 | 2025-11-13 | The Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed plugin for WordPress is vulnerable to unauthorize… |
CVE-2025-12891 | Medium | 5.3 | 2025-11-13 | The Survey Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ays_survey_show_results' AJAX endp… |
CVE-2025-12979 | Medium | 5.3 | 2025-11-13 | The Welcart e-Commerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'usces_export' action in all… |
CVE-2025-12892 | Medium | 5.3 | 2025-11-13 | The Survey Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() fu… |
CVE-2025-13063 | High | 7.3 | 2025-11-12 | A flaw has been found in DinukaNavaratna Dee Store 1.0. Affected is an unknown function. Executing manipulation can lead to missing authorization. The attack m… |
CVE-2025-64407 | Medium | 5.3 | 2025-11-12 | Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would ca… |
CVE-2025-64405 | High | 7.5 | 2025-11-12 | Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would ca… |
CVE-2025-64404 | High | 7.5 | 2025-11-12 | Apache OpenOffice documents can contain links to other files. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a documen… |
CVE-2025-64403 | High | 8.1 | 2025-11-12 | Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources". A missing Authorization vulnerability in Apache Op… |
CVE-2025-64402 | Medium | 6.5 | 2025-11-12 | Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would ca… |
CVE-2025-64401 | High | 7.5 | 2025-11-12 | Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would ca… |
CVE-2025-12633 | High | 7.5 | 2025-11-12 | The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2025-12113 | Medium | 4.3 | 2025-11-12 | The Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images plugin for WordPress is vulnerable to unauthorized loss of data due to a missing c… |
CVE-2025-30398 | High | 8.1 | 2025-11-11 | Missing authorization in Nuance PowerScribe allows an unauthorized attacker to disclose information over a network. |
CVE-2025-33185 | Medium | 5.3 | 2025-11-11 | NVIDIA AIStore contains a vulnerability in AuthN where an unauthenticated user may cause information disclosure. A successful exploit of this vulnerability ma… |
CVE-2025-12953 | Medium | 4.3 | 2025-11-11 | The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a… |
CVE-2025-5317 | Medium | 5.5 | 2025-11-11 | An improper access restriction to a folder in Bitdefender Endpoint Security Tools for Mac (BEST) before 7.20.52.200087 allows local users with administrative p… |
CVE-2025-12665 | Medium | 4.3 | 2025-11-11 | The Ninja Countdown | Fastest Countdown Builder plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ninja… |
CVE-2025-12526 | Medium | 4.3 | 2025-11-11 | The Private Google Calendars plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pgc_remove' acti… |
CVE-2025-11999 | Medium | 5.3 | 2025-11-11 | The Add Multiple Marker plugin for WordPress is vulnerable to unauthorized modification of data to due to a missing capability check on the addmultiplemarker_r… |
CVE-2025-11996 | Medium | 5.3 | 2025-11-11 | The Find Unused Images plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the fui_delete_image() and fui_dele… |
CVE-2025-11988 | Medium | 5.3 | 2025-11-11 | The Crypto plugin for WordPress is vulnerable to unauthorized manipulation of data in all versions up to, and including, 2.22. This is due to the plugin regist… |
CVE-2025-11894 | Medium | 5.3 | 2025-11-11 | The Shelf Planner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints in al… |
CVE-2025-42899 | Medium | 4.3 | 2025-11-11 | SAP S4CORE (Manage journal entries) does not perform necessary authorization checks for an authenticated user resulting in escalation of privileges. This has l… |
CVE-2025-42882 | Medium | 4.3 | 2025-11-11 | Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could execute a specific fun… |
CVE-2025-48878 | Medium | 4.3 | 2025-11-10 | Combodo iTop is a web based IT service management tool. In versions on the 3.x branch prior to 3.2.2, an insecure direct object reference allows a user (e.g. w… |
CVE-2025-64684 | Medium | 4.3 | 2025-11-10 | In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form |
CVE-2025-64681 | Low | 2.7 | 2025-11-10 | In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations |
CVE-2025-12925 | High | 7.3 | 2025-11-10 | A security flaw has been discovered in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. Impacted is the function getAll/addDic/getAllDic/deleteDic… |
CVE-2025-12924 | Medium | 4.3 | 2025-11-10 | A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. This issue affects the function GlobalResult of the file src/mai… |
CVE-2025-11448 | Medium | 4.3 | 2025-11-08 | The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-12498 | Medium | 4.3 | 2025-11-08 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized booking note creation due to a missing capability che… |
CVE-2025-7663 | Medium | 6.5 | 2025-11-08 | The Ovatheme Events Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the /class-ovae… |