CWE-862 · Missing Authorization (page 38)
Page 38 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-54705 | Medium | 4.3 | 2025-08-14 | Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-54695 | Medium | 5.4 | 2025-08-14 | Missing Authorization vulnerability in DevItems HT Mega ht-mega-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-54692 | High | 7.5 | 2025-08-14 | Missing Authorization vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Accessing Functionality Not Properly Constrained… |
CVE-2025-54679 | High | 7.5 | 2025-08-14 | Missing Authorization vulnerability in vertim Neon Channel Product Customizer Free neon-channel-product-customizer-free allows Exploiting Incorrectly Configure… |
CVE-2025-52801 | High | 7.3 | 2025-08-14 | Missing Authorization vulnerability in VonStroheim TheBooking thebooking allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects The… |
CVE-2025-52800 | High | 7.3 | 2025-08-14 | Missing Authorization vulnerability in Unity Business Technology Pty Ltd The E-Commerce ERP profitori allows Accessing Functionality Not Properly Constrained b… |
CVE-2025-52785 | High | 7.1 | 2025-08-14 | Missing Authorization vulnerability in softnwords SMM API smm-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SM… |
CVE-2025-52775 | High | 7.1 | 2025-08-14 | Missing Authorization vulnerability in Ronik@UnlimitedWP Project Cost Calculator project-cost-calculator allows Exploiting Incorrectly Configured Access Contro… |
CVE-2025-52731 | High | 7.5 | 2025-08-14 | Missing Authorization vulnerability in themefunction WordPress Event Manager, Event Calendar and Booking Plugin eventin-pro allows Exploiting Incorrectly Confi… |
CVE-2025-52721 | Medium | 6.5 | 2025-08-14 | Missing Authorization vulnerability in LCweb Global Gallery allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Global… |
CVE-2025-50031 | Medium | 6.5 | 2025-08-14 | Missing Authorization vulnerability in syedamirhussain91 DB Backup db-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-50029 | Medium | 6.5 | 2025-08-14 | Missing Authorization vulnerability in Ashish AI Tools artificial-intelligence-auto-content-generator allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-49052 | Medium | 4.3 | 2025-08-14 | Missing Authorization vulnerability in Dariolee Netease Music netease-music allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-31425 | High | 7.5 | 2025-08-14 | Missing Authorization vulnerability in kamleshyadav WP Lead Capturing Pages leadcapture allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-30993 | Medium | 6.5 | 2025-08-14 | Missing Authorization vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Exploiting Incorrectly Configu… |
CVE-2025-30639 | High | 7.5 | 2025-08-14 | Missing Authorization vulnerability in ThemeAtelier IDonatePro idonate-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-28962 | Medium | 6.5 | 2025-08-14 | Missing Authorization vulnerability in stefanoai Advanced Google Universal Analytics advanced-google-universal-analytics allows Exploiting Incorrectly Configur… |
CVE-2025-8943 | Critical | 9.8 | 2025-08-14 | The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent auth… |
CVE-2025-50171 | Critical | 9.1 | 2025-08-12 | Missing authorization in Remote Desktop Server allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-8310 | Medium | 6.5 | 2025-08-12 | Missing authorization in the admin console of Ivanti Virtual Application Delivery Controller before version 22.9 allows a remote authenticated attacker to take… |
CVE-2025-8482 | Medium | 4.3 | 2025-08-12 | The Simple Local Avatars plugin for WordPress is vulnerable to unauthorized modification of data in version 2.8.4. This is due to a missing capability check on… |
CVE-2025-8418 | High | 8.8 | 2025-08-12 | The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 1.1.30. T… |
CVE-2025-47444 | Medium | 5.3 | 2025-08-12 | Missing Authorization vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-6253 | High | 7.5 | 2025-08-12 | The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.3… |
CVE-2025-8059 | Critical | 9.8 | 2025-08-12 | The B Blocks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization and improper input validation within the rgfr_registration… |
CVE-2025-42955 | Low | 3.5 | 2025-08-12 | Due to a missing authorization check in SAP Cloud Connector, an attacker on an adjacent network with low privileges could send a crafted request to the endpoin… |
CVE-2025-42949 | Medium | 4.9 | 2025-08-12 | Due to a missing authorization check in the ABAP Platform, an authenticated user with elevated privileges could bypass authorization restrictions for common tr… |
CVE-2025-8285 | Medium | 4.0 | 2025-08-11 | Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create channel subscription without… |
CVE-2025-54458 | Medium | 5.0 | 2025-08-11 | Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the Confluence space which allows attackers to create a subscription for a… |
CVE-2025-53910 | Medium | 4.0 | 2025-08-11 | Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create a channel subscription withou… |
CVE-2025-53857 | Low | 3.7 | 2025-08-11 | Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details wit… |
CVE-2025-49221 | Low | 3.7 | 2025-08-11 | Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticated attackers to ac… |
CVE-2025-48731 | Medium | 6.4 | 2025-08-11 | Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the Confluence space which allows attackers to edit a subscription for a C… |
CVE-2025-44001 | Medium | 4.0 | 2025-08-11 | Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details wit… |
CVE-2025-8814 | Medium | 4.3 | 2025-08-10 | A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function setCookie of the file src/main/java/co/yiiu… |
CVE-2025-8807 | Medium | 6.3 | 2025-08-10 | A vulnerability was found in xujeff tianti 天梯 up to 2.3. It has been declared as critical. This vulnerability affects unknown code of the file /tianti-module-a… |
CVE-2025-8796 | Medium | 5.4 | 2025-08-10 | A vulnerability has been found in LitmusChaos Litmus up to 3.19.0 and classified as problematic. This vulnerability affects unknown code of the file /auth/dele… |
CVE-2025-8739 | Medium | 4.3 | 2025-08-08 | A vulnerability was found in zhenfeng13 My-Blog up to 1.0.0 and classified as problematic. This issue affects some unknown processing of the file /admin/tags/s… |
CVE-2025-51308 | Medium | 5.3 | 2025-08-06 | In Gatling Enterprise versions below 1.25.0, a low-privileged user that does not hold the role "admin" could perform a REST API call on read-only endpoints, al… |
CVE-2025-8595 | Medium | 4.3 | 2025-08-06 | The Zakra theme for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the welcome_notice_import_handler() function… |
CVE-2025-54608 | Medium | 6.2 | 2025-08-06 | Vulnerability that allows setting screen rotation direction without permission verification in the screen management module. Impact: Successful exploitation of… |
CVE-2025-41698 | High | 7.8 | 2025-08-05 | A low privileged local attacker can interact with the affected service although user-interaction should not be allowed. |
CVE-2025-6205 | Critical | 9.1 | 2025-08-04 | A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the a… |
CVE-2025-8505 | Medium | 4.3 | 2025-08-03 | A vulnerability has been found in 495300897 wx-shop up to de1b66331368695779cfc6e4d11a64caddf8716e and classified as problematic. This vulnerability affects un… |
CVE-2025-8488 | Medium | 4.3 | 2025-08-02 | The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) plugin for WordPress is vulnerable to unauthorized modification of data due to a… |
CVE-2025-8152 | Medium | 5.3 | 2025-08-02 | The WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabil… |
CVE-2025-6754 | High | 8.8 | 2025-08-02 | The SEO Metrics plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks in both the seo_metrics_handle_connect_button_cl… |
CVE-2025-8435 | High | 7.3 | 2025-08-01 | A vulnerability was found in code-projects Online Movie Streaming 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functiona… |
CVE-2025-8434 | High | 7.3 | 2025-08-01 | A vulnerability was found in code-projects Online Movie Streaming 1.0. It has been classified as critical. Affected is an unknown function of the file /admin.p… |
CVE-2025-8335 | Medium | 4.3 | 2025-07-30 | A vulnerability classified as problematic has been found in code-projects Simple Car Rental System 1.0. This affects an unknown part. The manipulation leads to… |
CVE-2025-53113 | Low | 2.7 | 2025-07-30 | GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, l… |
CVE-2025-53112 | Medium | 4.3 | 2025-07-30 | GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.1.0 t… |
CVE-2025-53111 | Medium | 6.5 | 2025-07-30 | GLPI is a Free Asset and IT Management Software package. In versions 0.80 through 10.0.18, a lack of permission checks can result in unauthorized access to som… |
CVE-2025-46811 | Critical | 9.8 | 2025-07-30 | A Missing Authorization vulnerability in SUSE Linux Manager allows anyone with the ability to connect to port 443 of SUSE Manager is able to run any command as… |
CVE-2025-8322 | High | 8.8 | 2025-07-30 | The e-School from Ventem has a Missing Authorization vulnerability, allowing remote attackers with regular privilege to access administrator functions, includi… |
CVE-2025-7689 | High | 8.8 | 2025-07-29 | The Hydra Booking plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the tfhb_reset_password_callback() function i… |
CVE-2025-6730 | Medium | 4.3 | 2025-07-29 | The Bonanza – WooCommerce Free Gifts Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the xlo_… |
CVE-2025-4370 | Medium | 5.3 | 2025-07-29 | The Brizy – Page Builder plugin for WordPress is vulnerable to limited file uploads due to missing authorization on process_external_asset_urls function as wel… |
CVE-2025-8223 | Medium | 4.3 | 2025-07-27 | A vulnerability, which was classified as problematic, was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. This aff… |
CVE-2025-54378 | High | 8.3 | 2025-07-26 | HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below… |
CVE-2023-7306 | High | 7.5 | 2025-07-25 | The Frontend File Manager Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpfm_delete_multiple_… |
CVE-2025-5835 | High | 8.8 | 2025-07-25 | The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data due to a missing capability check on the droip_post_apis() functio… |
CVE-2015-10143 | Critical | 9.8 | 2025-07-25 | The Platform theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on… |
CVE-2025-7822 | Medium | 4.3 | 2025-07-24 | The WP Wallcreeper plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_notices hook in all v… |
CVE-2025-7695 | High | 8.8 | 2025-07-24 | The Dataverse Integration plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within its reset_password_link REST en… |
CVE-2025-6441 | Critical | 9.8 | 2025-07-24 | The Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition plugin for WordPress is vulnerable to unauthen… |
CVE-2025-6380 | Critical | 9.8 | 2025-07-24 | The ONLYOFFICE Docs plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its oo.callback REST endpoint in versions 1… |
CVE-2025-1299 | Medium | 4.3 | 2025-07-24 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 18.0.5, all versions starting from 18.1 before 18.1.3, all versio… |
CVE-2025-6215 | Medium | 5.3 | 2025-07-23 | The Omnishop plugin for WordPress is vulnerable to Unauthenticated Registration Bypass in all versions up to, and including, 1.0.9. Its /users/register endpoin… |
CVE-2025-6190 | High | 8.8 | 2025-07-23 | The Realty Portal – Agent plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the rp_user_profile() AJAX handler in… |
CVE-2015-10140 | High | 8.8 | 2025-07-22 | The Ajax Load More plugin before 2.8.1.2 does not have authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber, to uplo… |
CVE-2025-6187 | Critical | 9.8 | 2025-07-22 | The bSecure plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its order_info REST endpoint in versions 1.3.7 throu… |
CVE-2025-7717 | High | 7.5 | 2025-07-21 | Missing Authorization vulnerability in Drupal File Download allows Forceful Browsing.This issue affects File Download: from 0.0.0 before 1.9.0, from 2.0.0 befo… |
CVE-2025-43720 | Medium | 6.5 | 2025-07-21 | Headwind MDM before 5.33.1 makes configuration details accessible to unauthorized users. The Configuration profile is exposed to the Observer user role, reveal… |
CVE-2025-43977 | Medium | 5.5 | 2025-07-21 | The com.skt.prod.dialer application through 12.5.0 for Android enables any installed application (with no permissions) to place phone calls without user intera… |
CVE-2025-43976 | Medium | 5.5 | 2025-07-21 | The com.enflick.android.tn2ndLine application through 24.17.1.0 for Android enables any installed application (with no permissions) to place phone calls withou… |
CVE-2025-7834 | Medium | 4.3 | 2025-07-19 | A vulnerability, which was classified as problematic, was found in PHPGurukul Complaint Management System 2.0. Affected is an unknown function. The manipulatio… |
CVE-2025-6721 | Medium | 5.3 | 2025-07-19 | The Vchasno Kasa plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the mrkv_vchasno_kasa_wc_do_metabox_act… |
CVE-2025-6720 | Medium | 5.3 | 2025-07-19 | The Vchasno Kasa plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the clear_all_log() function in all versi… |
CVE-2025-49747 | Critical | 9.9 | 2025-07-18 | Missing authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network. |
CVE-2025-7772 | Medium | 6.5 | 2025-07-18 | The Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and inc… |
CVE-2025-6726 | Medium | 4.3 | 2025-07-18 | The Block Editor Gallery Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the classic_galler… |
CVE-2025-6718 | High | 8.8 | 2025-07-18 | The B1.lt plugin for WordPress is vulnerable to SQL Injection due to a missing capability check on the b1_run_query AJAX action in all versions up to, and incl… |
CVE-2025-5811 | Medium | 5.3 | 2025-07-18 | The Listly: Listicles For WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Init() fun… |
CVE-2025-6813 | High | 8.8 | 2025-07-18 | The aapanel WP Toolkit plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within the auto_login() function in versi… |
CVE-2025-5816 | Medium | 4.3 | 2025-07-18 | The Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship plugin for WordPress is vulnerable to Insecure Direct Object Reference in all version… |
CVE-2025-7756 | Medium | 4.3 | 2025-07-17 | A vulnerability classified as problematic has been found in code-projects E-Commerce Site 1.0. Affected is an unknown function. The manipulation leads to cross… |
CVE-2025-3871 | Medium | 5.3 | 2025-07-16 | Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere On… |
CVE-2025-52804 | High | 7.5 | 2025-07-16 | Missing Authorization vulnerability in uxper Nuss nuss allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Nuss: from n/a throug… |
CVE-2025-52803 | High | 7.5 | 2025-07-16 | Missing Authorization vulnerability in uxper Sala allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sala: from n/a through 1… |
CVE-2025-50028 | Medium | 6.5 | 2025-07-16 | Missing Authorization vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-49888 | High | 7.1 | 2025-07-16 | Missing Authorization vulnerability in pimwick PW WooCommerce On Sale! pw-woocommerce-on-sale allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-49884 | Medium | 6.5 | 2025-07-16 | Missing Authorization vulnerability in alexvtn Internal Linking of Related Contents internal-linking-of-related-contents allows Exploiting Incorrectly Configur… |
CVE-2025-49319 | Medium | 6.5 | 2025-07-16 | Missing Authorization vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocommerce allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-48339 | Medium | 6.5 | 2025-07-16 | Missing Authorization vulnerability in activity-log.com Profiler - What Slowing Down Your WP allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-30959 | Medium | 6.5 | 2025-07-16 | Missing Authorization vulnerability in WPFactory Product XML Feed Manager for WooCommerce product-xml-feeds-for-woocommerce allows Exploiting Incorrectly Confi… |
CVE-2025-29000 | High | 7.5 | 2025-07-16 | Missing Authorization vulnerability in August Infotech Multi-language Responsive Contact Form responsive-contact-form allows Accessing Functionality Not Proper… |
CVE-2025-28965 | High | 8.6 | 2025-07-16 | Missing Authorization vulnerability in Md Yeasin Ul Haider URL Shortener exact-links allows Accessing Functionality Not Properly Constrained by ACLs.This issue… |
CVE-2025-54047 | Medium | 4.3 | 2025-07-16 | Missing Authorization vulnerability in QuanticaLabs Cost Calculator ql-cost-calculator allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-54037 | Medium | 5.4 | 2025-07-16 | Missing Authorization vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Exploiting Incorrectly Configured Access Control… |