CWE-862 · Missing Authorization (page 37)
Page 37 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-54744 | Medium | 6.5 | 2025-09-05 | Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Cont… |
CVE-2025-53571 | Medium | 6.5 | 2025-09-05 | Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2024-0028 | Medium | 5.5 | 2025-09-05 | In Audio Service, there is a possible way to obtain MAC addresses of nearby Bluetooth devices due to a missing permission check. This could lead to local escal… |
CVE-2025-58824 | Medium | 4.3 | 2025-09-05 | Missing Authorization vulnerability in priyanshumittal Shk Corporate shk-corporate allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-58817 | Medium | 4.3 | 2025-09-05 | Missing Authorization vulnerability in desertthemes SoftMe softme allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects So… |
CVE-2025-58816 | Low | 3.5 | 2025-09-05 | Missing Authorization vulnerability in Plugin Devs Product Carousel Slider for Elementor ecommerce-product-carousel-slider-for-elementor allows Exploiting Inco… |
CVE-2025-58813 | Medium | 4.3 | 2025-09-05 | Missing Authorization vulnerability in themearile Consultstreet consultstreet allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-58795 | Medium | 4.3 | 2025-09-05 | Missing Authorization vulnerability in Payoneer Checkout Payoneer Checkout payoneer-checkout allows Content Spoofing.This issue affects Payoneer Checkout: from… |
CVE-2025-58785 | Medium | 5.4 | 2025-09-05 | Missing Authorization vulnerability in Jiro Sasamoto Ray Enterprise Translation lingotek-translation allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-58783 | Medium | 4.3 | 2025-09-05 | Missing Authorization vulnerability in gutentor Gutentor gutentor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gu… |
CVE-2025-8944 | Medium | 4.3 | 2025-09-05 | The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any a… |
CVE-2025-22414 | High | 7.8 | 2025-09-04 | In FrpBypassAlertActivity of FrpBypassAlertActivity.java, there is a possible way to bypass FRP due to a missing permission check. This could lead to local esc… |
CVE-2025-48549 | High | 7.8 | 2025-09-04 | In multiple locations, there is a possible way to record audio via a background app due to a missing permission check. This could lead to local escalation of p… |
CVE-2025-48547 | High | 7.3 | 2025-09-04 | In multiple locations, there is a possible one-time permission bypass due to a logic error in the code. This could lead to local escalation of privilege with n… |
CVE-2025-48524 | Medium | 5.5 | 2025-09-04 | In isSystem of WifiPermissionsUtil.java, there is a possible permission bypass due to a missing permission check. This could lead to local denial of service wi… |
CVE-2025-0076 | Low | 3.3 | 2025-09-04 | In multiple locations, there is a possible way to view icons belonging to another user due to a missing permission check. This could lead to local information… |
CVE-2025-26450 | High | 7.8 | 2025-09-04 | In onInputEvent of IInputMethodSessionWrapper.java, there is a possible way for an untrusted app to inject key and motion events to the default IME due to a mi… |
CVE-2025-26445 | Medium | 5.5 | 2025-09-04 | In offerNetwork of ConnectivityService.java, there is a possible leak of sensitive data due to a missing permission check. This could lead to local information… |
CVE-2025-26440 | High | 7.8 | 2025-09-04 | In multiple functions of CameraService.cpp, there is a possible way to use the camera from the background due to a permissions bypass. This could lead to local… |
CVE-2025-26437 | Medium | 5.5 | 2025-09-04 | In CredentialManagerServiceStub of CredentialManagerService.java, there is a possible way to retrieve candidate credentials due to a missing permission check… |
CVE-2025-8268 | Medium | 6.5 | 2025-09-03 | The AI Engine plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the rest_list and delete_files fu… |
CVE-2025-58639 | Medium | 5.4 | 2025-09-03 | Missing Authorization vulnerability in Ali Khallad Contact Form By Mega Forms mega-forms allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-58635 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in DevItems Support Genix support-genix-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-58634 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in peachpay PeachPay Payments peachpay-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-58622 | Medium | 4.3 | 2025-09-03 | Missing Authorization vulnerability in yydevelopment Mobile Contact Line mobile-contact-line allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-58617 | Medium | 4.3 | 2025-09-03 | Missing Authorization vulnerability in FAKTOR VIER F4 Media Taxonomies f4-media-taxonomies allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-58616 | Medium | 6.5 | 2025-09-03 | Missing Authorization vulnerability in Frisbii Frisbii Pay reepay-checkout-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-58613 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-58606 | Medium | 5.0 | 2025-09-03 | Missing Authorization vulnerability in cozythemes SaasLauncher saaslauncher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-58603 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfe… |
CVE-2025-58601 | Medium | 4.3 | 2025-09-03 | Missing Authorization vulnerability in RadiusTheme Classified Listing classified-listing allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-58600 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-58599 | Medium | 4.3 | 2025-09-03 | Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Con… |
CVE-2025-58594 | Medium | 4.3 | 2025-09-03 | Missing Authorization vulnerability in themefusecom Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Briz… |
CVE-2025-58460 | Medium | 4.2 | 2025-09-03 | A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission to connect to an at… |
CVE-2025-3701 | Medium | 4.3 | 2025-09-03 | Missing Authorization vulnerability in Malcure Web Security Malcure Malware Scanner wp-malware-removal allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-9219 | Medium | 4.3 | 2025-09-03 | The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin fo… |
CVE-2025-58210 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in ThemeMove Makeaholic makeaholic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-22439 | High | 7.3 | 2025-09-02 | In onLastAccessedStackLoaded of ActionHandler.java , there is a possible way to bypass storage restrictions across apps due to a missing permission check. This… |
CVE-2025-6685 | High | 8.8 | 2025-09-02 | ATEN eco DC Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installatio… |
CVE-2025-9747 | Medium | 4.3 | 2025-08-31 | A vulnerability has been found in Koillection up to 1.6.18. Affected is an unknown function of the file assets/controllers/csrf_protection_controller.js. Such… |
CVE-2024-32832 | Critical | 9.8 | 2025-08-31 | Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a throug… |
CVE-2024-32589 | High | 7.1 | 2025-08-31 | Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-prod… |
CVE-2025-54943 | Critical | 9.8 | 2025-08-30 | A missing authorization vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to perform unauthorized application d… |
CVE-2025-43773 | Critical | 9.1 | 2025-08-29 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 20… |
CVE-2025-58334 | High | 8.1 | 2025-08-28 | In JetBrains IDE Services before 2025.5.0.1086, 2025.4.2.2164 users without appropriate permissions could assign high-privileged role for themselves |
CVE-2025-54734 | Medium | 5.8 | 2025-08-28 | Missing Authorization vulnerability in bPlugins B Slider b-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects B… |
CVE-2025-54733 | Medium | 6.5 | 2025-08-28 | Missing Authorization vulnerability in all_bootstrap_blocks All Bootstrap Blocks all-bootstrap-blocks allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-54714 | High | 7.1 | 2025-08-28 | Missing Authorization vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-54710 | High | 7.1 | 2025-08-28 | Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Ti… |
CVE-2025-53337 | Medium | 5.4 | 2025-08-28 | Missing Authorization vulnerability in Ashan Perera LifePress lifepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-53230 | High | 7.6 | 2025-08-28 | Missing Authorization vulnerability in honzat Page Manager for Elementor page-manager-for-elementor allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-48350 | Medium | 4.3 | 2025-08-28 | Missing Authorization vulnerability in Basar Ventures AutoWP autowp-ai-content-writer-rewriter allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-48327 | Medium | 5.3 | 2025-08-28 | Missing Authorization vulnerability in inkthemes WP Mailgun SMTP wp-mailgun-smtp allows Accessing Functionality Not Properly Constrained by ACLs.This issue aff… |
CVE-2025-7956 | Medium | 5.3 | 2025-08-28 | The Ajax Search Lite plugin for WordPress is vulnerable to Basic Information Exposure due to missing authorization in its AJAX search handler in all versions u… |
CVE-2025-0951 | Medium | 4.3 | 2025-08-28 | Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquid_reset_wordpr… |
CVE-2025-2246 | Medium | 5.8 | 2025-08-27 | An issue has been discovered in GitLab CE/EE affecting all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that could have allowed unauthent… |
CVE-2025-58201 | Medium | 5.3 | 2025-08-27 | Missing Authorization vulnerability in AfterShip & Automizely AfterShip Tracking aftership-woocommerce-tracking allows Accessing Functionality Not Properly Con… |
CVE-2025-58198 | Medium | 6.5 | 2025-08-27 | Missing Authorization vulnerability in Xpro Xpro Theme Builder xpro-theme-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-58193 | Medium | 4.3 | 2025-08-27 | Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-58192 | Medium | 4.3 | 2025-08-27 | Missing Authorization vulnerability in Xylus Themes WP Bulk Delete wp-bulk-delete allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-0086 | Medium | 6.2 | 2025-08-26 | In onResult of AccountManagerService.java, there is a possible way to overwrite auth token due to a missing permission check. This could lead to local informat… |
CVE-2025-48108 | Medium | 6.5 | 2025-08-26 | Missing Authorization vulnerability in Mojoomla School Management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sc… |
CVE-2024-8860 | Medium | 4.3 | 2025-08-26 | The Tourfic plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tf_order_status_email_resend_funct… |
CVE-2025-7828 | Medium | 4.3 | 2025-08-23 | The WP Filter & Combine RSS Feeds plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the post_listing… |
CVE-2025-7827 | Medium | 4.3 | 2025-08-23 | The Ni WooCommerce Customer Product Report plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ni_… |
CVE-2025-7821 | Medium | 5.3 | 2025-08-23 | The WC Plus plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pluswc_logo_favicon_logo_base' AJ… |
CVE-2025-55741 | High | 8.1 | 2025-08-22 | UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. In versions 0.3.0 and earlier, users without the Delete pr… |
CVE-2025-9331 | Medium | 4.3 | 2025-08-22 | The Spacious theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'welcome_notice_import_handler' fu… |
CVE-2025-57896 | Medium | 5.3 | 2025-08-22 | Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-57894 | Medium | 4.3 | 2025-08-22 | Missing Authorization vulnerability in ollybach WPPizza wppizza allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPPi… |
CVE-2025-57884 | Medium | 4.3 | 2025-08-22 | Missing Authorization vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-52352 | Critical | 9.8 | 2025-08-21 | Aikaan IoT management platform v3.25.0325-5-g2e9c59796 provides a configuration to disable user sign-up in distributed deployments by hiding the sign-up option… |
CVE-2025-54040 | Medium | 6.5 | 2025-08-20 | Missing Authorization vulnerability in Webba Appointment Booking Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-54025 | Medium | 6.5 | 2025-08-20 | Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-49406 | High | 8.5 | 2025-08-20 | Missing Authorization vulnerability in favethemes Houzez allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Houzez: from n/a t… |
CVE-2025-49396 | Medium | 4.3 | 2025-08-20 | Missing Authorization vulnerability in themifyme Themify Builder themify-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-9202 | Medium | 4.3 | 2025-08-20 | The ColorMag theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the welcome_notice_import_handler() fu… |
CVE-2025-55734 | Medium | 6.5 | 2025-08-19 | flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, the code checks if the userRole is "admin" only when visiting the /admin page, but not when vis… |
CVE-2025-4046 | High | 8.5 | 2025-08-19 | A missing authorization vulnerability in Lexmark Cloud Services badge management allows attacker to reassign badges within their organization |
CVE-2025-8357 | Medium | 4.3 | 2025-08-19 | The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file deletion in the /wp-content/uploads directory due to insufficient file path va… |
CVE-2025-7499 | Medium | 5.3 | 2025-08-16 | The BetterDocs – Advanced AI-Driven Documentation, FAQ & Knowledge Base Tool for Elementor & Gutenberg with Encyclopedia, AI Support, Instant Answers plugin fo… |
CVE-2025-8898 | Critical | 9.8 | 2025-08-16 | The Taxi Booking Manager for Woocommerce | E-cab plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and inc… |
CVE-2025-7664 | High | 7.5 | 2025-08-16 | The AL Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the check_activate_permission() permission callback… |
CVE-2025-8996 | Medium | 4.3 | 2025-08-15 | Missing Authorization vulnerability in Drupal Layout Builder Advanced Permissions allows Forceful Browsing.This issue affects Layout Builder Advanced Permissio… |
CVE-2025-8361 | High | 7.6 | 2025-08-15 | Missing Authorization vulnerability in Drupal Config Pages allows Forceful Browsing. This issue affects Config Pages: from 0.0.0 before 2.18.0. |
CVE-2025-49432 | Medium | 5.3 | 2025-08-15 | Missing Authorization vulnerability in FWDesign Ultimate Video Player fwduvp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-8342 | High | 8.1 | 2025-08-15 | The WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass due to insufficient empty value check… |
CVE-2025-8992 | Medium | 4.3 | 2025-08-15 | A vulnerability has been found in mtons mblog up to 3.5.0. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request f… |
CVE-2025-55716 | Medium | 4.3 | 2025-08-14 | Missing Authorization vulnerability in VeronaLabs WP Statistics wp-statistics allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-55712 | Medium | 6.5 | 2025-08-14 | Missing Authorization vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Exploiting In… |
CVE-2025-54739 | Medium | 5.3 | 2025-08-14 | Missing Authorization vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-54730 | Medium | 5.3 | 2025-08-14 | Missing Authorization vulnerability in PARETO Digital Embedder for Google Reviews embedder-for-google-reviews allows Accessing Functionality Not Properly Const… |
CVE-2025-54717 | Medium | 5.4 | 2025-08-14 | Missing Authorization vulnerability in e-plugins WP Membership wp-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-54712 | Medium | 4.3 | 2025-08-14 | Missing Authorization vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-53343 | Medium | 4.3 | 2025-08-14 | Missing Authorization vulnerability in GoodLayers Modernize modernize allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-53341 | Medium | 4.3 | 2025-08-14 | Missing Authorization vulnerability in Themovation App, SaaS & Software Startup Tech Theme - Stratus stratusx allows Exploiting Incorrectly Configured Access C… |
CVE-2025-53221 | Medium | 4.3 | 2025-08-14 | Missing Authorization vulnerability in codeablepress CodeablePress codeablepress-simple-frontend-profile-picture-upload allows Exploiting Incorrectly Configure… |
CVE-2025-20302 | Medium | 4.3 | 2025-08-14 | A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, low-privileged, remote attacker to retrieve a… |
CVE-2025-20301 | Medium | 6.5 | 2025-08-14 | A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, low-privileged, remote attacker to access trou… |