CWE-862 · Missing Authorization (page 33)
Page 33 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12167 | Medium | 4.3 | 2025-11-08 | The Contact Form 7 AWeber Extension plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_a… |
CVE-2025-12042 | Medium | 5.3 | 2025-11-08 | The Course Booking System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in the csv-export.php file in all… |
CVE-2025-12583 | Medium | 6.4 | 2025-11-08 | The Simple Downloads List plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_neofix_sdl_… |
CVE-2025-12527 | Medium | 4.3 | 2025-11-07 | The Page & Post Notes plugin for WordPress is vulnerable to unauthorized modification of notes due to a missing capability check on the 'yydev_notes_save_dashb… |
CVE-2025-4522 | Medium | 6.5 | 2025-11-07 | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the admin_post_don… |
CVE-2025-64323 | Medium | 5.3 | 2025-11-07 | kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.4 and below and 2.1.0-agw-cel-rbac through 2.1.0-rc.2 lack authentication, allowing any client with… |
CVE-2025-5483 | High | 8.1 | 2025-11-07 | The LC Wizard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check in the ghl-wizard/inc/wp_user.php file in versions 1… |
CVE-2025-64179 | Medium | 5.3 | 2025-11-06 | lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authentication in the /api/v1/… |
CVE-2025-62914 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in anibalwainstein Effect Maker effect-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-62049 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder.This issue affects Cost Calculator Builder: from n/a through <=… |
CVE-2025-62046 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in CodexThemes TheGem Demo Import (for WPBakery) thegem-importer.This issue affects TheGem Demo Import (for WPBakery): from… |
CVE-2025-62037 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4. |
CVE-2025-62033 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4. |
CVE-2025-62028 | Medium | 4.3 | 2025-11-06 | Missing Authorization vulnerability in ThemeNectar Salient salient.This issue affects Salient: from n/a through < 17.4.0. |
CVE-2025-62018 | Medium | 5.3 | 2025-11-06 | Missing Authorization vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through <= 4.22.0. |
CVE-2025-62017 | Medium | 5.4 | 2025-11-06 | Missing Authorization vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through <= 4.22.0. |
CVE-2025-60247 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in Bux Bux Woocommerce bux-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects B… |
CVE-2025-5803 | Medium | 5.3 | 2025-11-06 | Missing Authorization vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking.This issue affects VikBooking Hotel Booking Engine & PMS: from… |
CVE-2025-58986 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in ganddser Jock On Air Now (JOAN) joan allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-58629 | High | 7.5 | 2025-11-06 | Missing Authorization vulnerability in kamleshyadav Miraculous miraculous allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-58243 | Medium | 5.3 | 2025-11-06 | Missing Authorization vulnerability in Jthemes imEvent imevent allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects imEvent: from… |
CVE-2025-58207 | High | 8.2 | 2025-11-06 | Missing Authorization vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-generator-for-wp allows Exploiting Incorrectly Configure… |
CVE-2025-54711 | High | 7.1 | 2025-11-06 | Missing Authorization vulnerability in bPlugins Info Cards info-cards allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Info C… |
CVE-2025-53246 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in Gaurav Aggarwal Backup and Move backup-and-move allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-53214 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in sertifier Sertifier Certificate & Badge Maker sertifier-certificates-open-badges allows Exploiting Incorrectly Configure… |
CVE-2025-49394 | High | 7.1 | 2025-11-06 | Missing Authorization vulnerability in bPlugins Image Gallery block – Create and display photo gallery/photo album. 3d-image-gallery allows Accessing Functiona… |
CVE-2025-39465 | Medium | 4.3 | 2025-11-06 | Missing Authorization vulnerability in flippercode Advanced Google Maps wp-google-map-gold allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-12563 | Medium | 4.3 | 2025-11-06 | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to limited file upload due to an incorrect capability check on theupload… |
CVE-2025-64171 | | 2025-11-06 | MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-namespace secret access vulnerability in… | |
CVE-2025-12469 | Medium | 4.3 | 2025-11-05 | The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all v… |
CVE-2025-12675 | Medium | 4.3 | 2025-11-05 | The KiotViet Sync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveConfig() function in all… |
CVE-2025-12384 | High | 8.6 | 2025-11-05 | The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to unauthorized access/modification/loss of data in all ver… |
CVE-2025-11373 | Medium | 4.3 | 2025-11-05 | The Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel plugin fo… |
CVE-2025-11835 | Medium | 5.3 | 2025-11-05 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modific… |
CVE-2025-12582 | Medium | 4.3 | 2025-11-05 | The Features plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'features_revert_option AJAX endp… |
CVE-2025-63294 | Medium | 6.5 | 2025-11-04 | WorkDo HRM SaaS HR and Payroll Tool 8.1 is affected vulnerable to Insecure Permissions. An authenticated user can create leave or resignation records on behalf… |
CVE-2025-41345 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41344 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41343 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41342 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41341 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41340 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41339 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41338 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41337 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41336 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41335 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41114 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41113 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41112 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41111 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-12389 | Medium | 4.3 | 2025-11-04 | The Import Export For WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_setti… |
CVE-2025-12350 | Medium | 5.3 | 2025-11-04 | The DominoKit plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wp_ajax_nopriv_dominokit_option_admin_action A… |
CVE-2025-12158 | Critical | 9.8 | 2025-11-04 | The Simple User Capabilities plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the suc_submit_capabilities() func… |
CVE-2025-12157 | Medium | 5.3 | 2025-11-04 | The Simple User Capabilities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_nopriv_r… |
CVE-2025-12156 | Medium | 4.3 | 2025-11-04 | The Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin for WordPress is vulnerable to unauthorized modification of data due to… |
CVE-2025-11890 | High | 7.5 | 2025-11-04 | The Crypto Payment Gateway with Payeer for WooCommerce plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 1.0.3. This i… |
CVE-2025-11758 | Medium | 6.5 | 2025-11-04 | The All in One Time Clock Lite plugin for WordPress is vulnerable to unauthorized access due to a missing authorization check in all versions up to, and includ… |
CVE-2025-10896 | High | 8.8 | 2025-11-04 | Multiple plugins for WordPress with the Jewel Theme Recommended Plugins Library are vulnerable to Unrestricted Upload of File with Dangerous Type via arbitrary… |
CVE-2025-63293 | Medium | 6.5 | 2025-11-03 | FairSketch Rise Ultimate Project Manager & CRM 3.9.4 is vulnerable to Insecure Permissions. A remote authenticated user can append comments or upload attachmen… |
CVE-2025-64294 | Medium | 5.3 | 2025-11-03 | Missing Authorization vulnerability in d3wp WP Snow Effect wp-snow-effect allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP… |
CVE-2025-36367 | High | 8.8 | 2025-11-01 | IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 is vulnerable to privilege escalation caused by an invalid IBM i SQL services authorization check. A malicious actor can use… |
CVE-2025-12180 | Medium | 4.3 | 2025-11-01 | The Qi Blocks plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.3. This is due to the plugin storing arbitr… |
CVE-2025-11833 | Critical | 9.8 | 2025-11-01 | The Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a m… |
CVE-2025-11816 | Medium | 5.3 | 2025-11-01 | The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized modification of… |
CVE-2025-64349 | High | 8.8 | 2025-10-31 | ELOG allows an authenticated user to modify another user's profile. An attacker can edit a target user's email address, then request a password reset, and take… |
CVE-2025-64348 | High | 7.1 | 2025-10-31 | ELOG allows an authenticated user to modify or overwrite the configuration file, resulting in denial of service. If the execute facility is specifically enable… |
CVE-2025-64358 | Medium | 4.3 | 2025-10-31 | Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce wt-smart-coupons-for-woocommerce allows Exploiting Incorrectly Configured Access… |
CVE-2025-64356 | Medium | 4.3 | 2025-10-31 | Missing Authorization vulnerability in f1logic Insert PHP Code Snippet insert-php-code-snippet allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-64352 | Low | 2.7 | 2025-10-31 | Missing Authorization vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Exploiting Incorrectly Configured… |
CVE-2025-64350 | Low | 3.8 | 2025-10-31 | Missing Authorization vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-12041 | Medium | 5.3 | 2025-10-31 | The ERI File Library plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'erifl_file' AJAX action in all… |
CVE-2025-12175 | Medium | 4.3 | 2025-10-31 | The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'tec_qr_code_modal' AJAX endpoint in… |
CVE-2025-11191 | Medium | 5.3 | 2025-10-31 | The RealPress WordPress plugin before 1.1.0 registers the REST routes without proper permission checks, allowing the creation of pages and sending of emails f… |
CVE-2025-11975 | Medium | 4.3 | 2025-10-31 | The FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) plugin for WordPress is vulnerable to… |
CVE-2024-13994 | Critical | 9.8 | 2025-10-30 | Nagios XI versions prior to 2024R1.1.2 contain a missing authorization control when the 'Allow Insecure Logins' option is enabled. Under this configuration, an… |
CVE-2023-7317 | High | 8.8 | 2025-10-30 | Nagios XI versions prior to 2024R1 contain a missing access control vulnerability via the Web SSH Terminal. A remote, low-privileged attacker could access or i… |
CVE-2013-10072 | Medium | 6.5 | 2025-10-30 | Nagios XI versions prior to 2012R1.6 contain an authorization flaw in the Auto-Discovery functionality. Users with read-only roles could directly reach Auto-Di… |
CVE-2025-62712 | Critical | 9.6 | 2025-10-30 | JumpServer is an open source bastion host and an operation and maintenance security audit system. In JumpServer versions prior to v3.10.20-lts and v4.10.11-lts… |
CVE-2025-11881 | Medium | 5.3 | 2025-10-30 | The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'myappp_verify… |
CVE-2025-10008 | Medium | 5.3 | 2025-10-30 | The Translate WordPress and go Multilingual – Weglot plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the '… |
CVE-2025-9954 | High | 7.5 | 2025-10-30 | Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DAM: from 0.0.0 before 1.1.5. |
CVE-2025-64150 | Medium | 5.4 | 2025-10-29 | A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-speci… |
CVE-2025-64148 | Medium | 4.3 | 2025-10-29 | A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of… |
CVE-2025-64142 | Medium | 4.3 | 2025-10-29 | A missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specif… |
CVE-2025-64139 | Medium | 4.3 | 2025-10-29 | A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-… |
CVE-2025-64137 | Medium | 4.3 | 2025-10-29 | A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP se… |
CVE-2025-64132 | Medium | 5.4 | 2025-10-29 | Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and ob… |
CVE-2025-11632 | Medium | 4.3 | 2025-10-29 | The Call Now Button – The #1 Click to Call Button for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability c… |
CVE-2025-11587 | Medium | 4.3 | 2025-10-29 | The Call Now Button – The #1 Click to Call Button for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi… |
CVE-2025-64285 | Medium | 5.4 | 2025-10-29 | Missing Authorization vulnerability in Premmerce Premmerce Wholesale Pricing for WooCommerce premmerce-woocommerce-wholesale-pricing allows Exploiting Incorrec… |
CVE-2025-64234 | Medium | 4.3 | 2025-10-29 | Missing Authorization vulnerability in Evergreen Content Poster Evergreen Content Poster evergreen-content-poster allows Exploiting Incorrectly Configured Acce… |
CVE-2025-64229 | Medium | 4.3 | 2025-10-29 | Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-64219 | Medium | 4.3 | 2025-10-29 | Missing Authorization vulnerability in Strategy11 Team Business Directory business-directory-plugin allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-64212 | Medium | 5.4 | 2025-10-29 | Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Exploiting Incorrectly Configur… |
CVE-2025-64211 | Medium | 5.3 | 2025-10-29 | Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets masterstudy-elementor-widgets allows Accessing Functionality Not Properly C… |
CVE-2025-64210 | Medium | 5.4 | 2025-10-29 | Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets masterstudy-elementor-widgets allows Exploiting Incorrectly Configured Acce… |
CVE-2025-64199 | Medium | 5.3 | 2025-10-29 | Missing Authorization vulnerability in WpEstate wpresidence wpresidence allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-58711 | Medium | 5.3 | 2025-10-29 | Missing Authorization vulnerability in solwin Blog Designer PRO blog-designer-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue af… |
CVE-2025-11702 | High | 8.5 | 2025-10-29 | GitLab has remediated an issue in EE affecting all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an auth… |