CWE-862 · Missing Authorization (page 39)
Page 39 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-54018 | Medium | 4.3 | 2025-07-16 | Missing Authorization vulnerability in CreativeMindsSolutions CM Pop-Up banners cm-pop-up-banners allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-54011 | Medium | 4.3 | 2025-07-16 | Missing Authorization vulnerability in SMTP2GO SMTP2GO smtp2go allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMTP2… |
CVE-2025-53997 | Medium | 4.3 | 2025-07-16 | Missing Authorization vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houz… |
CVE-2025-53986 | Medium | 5.3 | 2025-07-16 | Missing Authorization vulnerability in themeisle Hestia hestia allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hestia: from… |
CVE-2025-48167 | Medium | 5.4 | 2025-07-16 | Missing Authorization vulnerability in alexvtn Chatbox Manager wa-chatbox-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-48166 | Medium | 5.3 | 2025-07-16 | Missing Authorization vulnerability in sminozzi Stop and Block bots plugin Anti bots antibots allows Accessing Functionality Not Properly Constrained by ACLs.T… |
CVE-2025-48155 | Medium | 5.3 | 2025-07-16 | Missing Authorization vulnerability in enituretechnology Residential Address Detection residential-address-detection allows Accessing Functionality Not Properl… |
CVE-2025-48150 | Medium | 4.3 | 2025-07-16 | Missing Authorization vulnerability in sminozzi Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin real-estate-right-now allows Exploiti… |
CVE-2025-6993 | High | 7.5 | 2025-07-16 | The Ultimate WP Mail plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the get_email_log_details() AJAX handler i… |
CVE-2025-6043 | High | 8.1 | 2025-07-16 | The Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary File Deletion due to a missing capabilit… |
CVE-2025-49829 | Medium | 6.5 | 2025-07-15 | Conjur provides secrets management and application identity for infrastructure. Missing validations in Secrets Manager, Self-Hosted allows authenticated attack… |
CVE-2025-53959 | High | 7.6 | 2025-07-15 | In JetBrains YouTrack before 2025.2.86069, 2024.3.85077, 2025.1.86199 email spoofing via an administrative API was possible |
CVE-2025-5394 | Critical | 9.8 | 2025-07-15 | The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on th… |
CVE-2025-53825 | Critical | 9.4 | 2025-07-14 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to version 0.24.3, an unauthenticated preview deployment vulnerability in Dokploy allows a… |
CVE-2025-53640 | Medium | 6.5 | 2025-07-14 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3… |
CVE-2025-52954 | High | 7.8 | 2025-07-11 | A Missing Authorization vulnerability in the internal virtual routing and forwarding (VRF) of Juniper Networks Junos OS Evolved allows a local, low-privileged… |
CVE-2025-52950 | Critical | 9.6 | 2025-07-11 | A Missing Authorization vulnerability in Juniper Networks Security Director allows an unauthenticated network-based attacker to read or tamper with multiple se… |
CVE-2025-3780 | Medium | 6.5 | 2025-07-09 | The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modificatio… |
CVE-2025-49723 | High | 8.8 | 2025-07-08 | Missing authorization in Windows StateRepository API allows an authorized attacker to perform tampering locally. |
CVE-2025-5957 | Medium | 5.3 | 2025-07-08 | The Guest Support – Complete customer support ticket system for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capa… |
CVE-2025-42986 | Medium | 4.3 | 2025-07-08 | Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could call a Remote Func… |
CVE-2025-42974 | Medium | 4.3 | 2025-07-08 | Due to missing authorization check, an attacker authenticated as a non-administrative user could call a remote-enabled function module. This could enable acces… |
CVE-2025-42968 | Medium | 5.0 | 2025-07-08 | SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information… |
CVE-2025-42961 | Medium | 4.9 | 2025-07-08 | Due to a missing authorization check in SAP NetWeaver Application server for ABAP, an authenticated user with high privileges could exploit the insufficient va… |
CVE-2025-42960 | Medium | 4.3 | 2025-07-08 | SAP Business Warehouse and SAP BW/4HANA BEx Tools allow an authenticated attacker to gain higher access levels than intended by exploiting improper authorizati… |
CVE-2025-42953 | High | 8.1 | 2025-07-08 | SAP Netweaver System Configuration does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This could… |
CVE-2025-42952 | High | 7.7 | 2025-07-08 | SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to add fields to arbitrary SAP database tables and/or structures, potentially ren… |
CVE-2025-53499 | Critical | 9.1 | 2025-07-07 | Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFi… |
CVE-2025-53495 | Critical | 9.1 | 2025-07-07 | Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFi… |
CVE-2025-53374 | Medium | 4.3 | 2025-07-07 | Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated low-privi… |
CVE-2025-7133 | Medium | 4.3 | 2025-07-07 | A vulnerability classified as problematic has been found in CodeAstro Online Movie Ticket Booking System 1.0. This affects an unknown part. The manipulation le… |
CVE-2025-7078 | Medium | 4.3 | 2025-07-06 | A vulnerability classified as problematic was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.3.9. This vulnerability affects unknown code. The manipulation… |
CVE-2025-53485 | High | 7.5 | 2025-07-04 | SetTranslationHandler.php does not validate that the user is an election admin, allowing any (even unauthenticated) user to change election-related translation… |
CVE-2025-52813 | High | 8.1 | 2025-07-04 | Missing Authorization vulnerability in pietro MobiLoud allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MobiLoud: fr… |
CVE-2025-50039 | Medium | 6.5 | 2025-07-04 | Missing Authorization vulnerability in vgwort VG WORT METIS vgw-metis allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-50032 | Medium | 6.5 | 2025-07-04 | Missing Authorization vulnerability in Paytiko - Payment Orchestration Platform Paytiko for WooCommerce paytiko allows Exploiting Incorrectly Configured Access… |
CVE-2025-49431 | Medium | 6.5 | 2025-07-04 | Missing Authorization vulnerability in Gnuget MF Plus WPML mf-plus-wpml allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-47634 | Medium | 6.5 | 2025-07-04 | Missing Authorization vulnerability in Keylor Mendoza WC Pickup Store wc-pickup-store allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-47565 | Medium | 6.3 | 2025-07-04 | Missing Authorization vulnerability in ashanjay EventON eventon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Even… |
CVE-2025-30929 | Medium | 5.3 | 2025-07-04 | Missing Authorization vulnerability in amazewp fluXtore fluxtore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects flu… |
CVE-2025-29012 | Medium | 5.3 | 2025-07-04 | Missing Authorization vulnerability in kamleshyadav CF7 7 Mailchimp Add-on CF7-mailchimp-addon allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-29007 | Medium | 4.3 | 2025-07-04 | Missing Authorization vulnerability in LMSACE LMSACE Connect lmsace-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-29001 | Medium | 4.3 | 2025-07-04 | Missing Authorization vulnerability in ZoomIt WooCommerce Shop Page Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue… |
CVE-2025-24757 | Medium | 5.3 | 2025-07-04 | Missing Authorization vulnerability in AndonDesign uDesign udesign.This issue affects uDesign: from n/a through <= 4.11.2. |
CVE-2025-24748 | Medium | 5.3 | 2025-07-04 | Missing Authorization vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through <= 7.11.10. |
CVE-2025-6814 | High | 7.5 | 2025-07-04 | The Booking X plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_now() function in versions 1.0… |
CVE-2025-5956 | Medium | 6.5 | 2025-07-04 | The WP Human Resource Management plugin for WordPress is vulnerable to Arbitrary User Deletion due to a missing authorization within the ajax_delete_employee()… |
CVE-2025-5953 | High | 8.8 | 2025-07-04 | The WP Human Resource Management plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the ajax_insert_employee() and upda… |
CVE-2025-52554 | Medium | 4.3 | 2025-07-03 | n8n is a workflow automation platform. Prior to version 1.99.1, an authorization vulnerability was discovered in the /rest/executions/:id/stop endpoint of n8n… |
CVE-2025-3702 | Medium | 5.4 | 2025-07-03 | Missing Authorization vulnerability in Melapress Melapress File Monitor website-file-changes-monitor allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-27461 | High | 7.6 | 2025-07-03 | During startup, the device automatically logs in the EPC2 Windows user without requesting a password. |
CVE-2025-53108 | | 2025-07-02 | HomeBox is a home inventory and organization system. Prior to 0.20.1, HomeBox contains a missing authorization check in the API endpoints responsible for updat… | |
CVE-2025-39362 | Medium | 6.5 | 2025-07-02 | Missing Authorization vulnerability in Mollie Mollie Payments for WooCommerce mollie-payments-for-woocommerce.This issue affects Mollie Payments for WooCommerc… |
CVE-2025-5692 | Medium | 6.3 | 2025-07-02 | The Lead Form Data Collection to CRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ~/… |
CVE-2025-46259 | Medium | 5.4 | 2025-07-01 | Missing Authorization vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-6865 | Medium | 4.3 | 2025-06-29 | A vulnerability, which was classified as problematic, was found in DaiCuo up to 1.3.13. This affects an unknown part of the file /admin.php/addon/index. The ma… |
CVE-2025-6864 | Medium | 4.3 | 2025-06-29 | A vulnerability, which was classified as problematic, has been found in SeaCMS up to 13.2. Affected by this issue is some unknown functionality of the file /ad… |
CVE-2025-5304 | Critical | 9.8 | 2025-06-28 | The PT Project Notebooks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the wpnb_pto_new_users_add() function in ve… |
CVE-2025-53323 | Medium | 4.3 | 2025-06-27 | Missing Authorization vulnerability in danbriapps Pre-Publish Post Checklist pre-publish-post-checklist allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-53318 | Medium | 5.4 | 2025-06-27 | Missing Authorization vulnerability in WPManiax WP DB Booster wp-db-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-53304 | Medium | 5.3 | 2025-06-27 | Missing Authorization vulnerability in Rohil Contact Form – 7 : Hide Success Message contact-form-7-hide-success-message allows Accessing Functionality Not Pro… |
CVE-2025-53295 | Medium | 5.3 | 2025-06-27 | Missing Authorization vulnerability in iCount iCount Payment Gateway icount allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects… |
CVE-2025-53293 | Medium | 4.3 | 2025-06-27 | Missing Authorization vulnerability in Morten Dalgaard Johansen Dashboard Widget Sidebar dashboard-widget-sidebar allows Exploiting Incorrectly Configured Acce… |
CVE-2025-53288 | Medium | 4.3 | 2025-06-27 | Missing Authorization vulnerability in Adrian Ladó PlatiOnline Payments plationline allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-53284 | Medium | 6.5 | 2025-06-27 | Missing Authorization vulnerability in pankaj.sakaria CMS Blocks cms-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-53266 | Medium | 4.3 | 2025-06-27 | Missing Authorization vulnerability in EdwardBock Cron Logger cron-logger allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-53255 | Medium | 5.3 | 2025-06-27 | Missing Authorization vulnerability in Nabil Lemsieh HurryTimer hurrytimer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-53200 | Medium | 4.3 | 2025-06-27 | Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-52824 | High | 8.8 | 2025-06-27 | Missing Authorization vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-52818 | High | 8.2 | 2025-06-27 | Missing Authorization vulnerability in Dejan Jasnic Trusty Whistleblowing trusty-whistleblowing-solution allows Exploiting Incorrectly Configured Access Contro… |
CVE-2025-52817 | High | 8.2 | 2025-06-27 | Missing Authorization vulnerability in ZealousWeb Abandoned Contact Form 7 abandoned-contact-form-7 allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-5846 | Low | 2.7 | 2025-06-26 | An issue has been discovered in GitLab EE affecting all versions from 16.10 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed… |
CVE-2025-5315 | Medium | 4.3 | 2025-06-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowe… |
CVE-2025-5813 | Medium | 5.3 | 2025-06-26 | The Amazon Products to WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcta2w_get_… |
CVE-2025-5812 | Medium | 4.3 | 2025-06-26 | The VG WORT METIS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gutenberg_save_post() functi… |
CVE-2025-3863 | Medium | 4.3 | 2025-06-26 | The Post Carousel Slider for Elementor plugin for WordPress is vulnerable to improper authorization due to a missing capability check on the process_wbelps_pro… |
CVE-2025-6664 | Medium | 4.3 | 2025-06-25 | A vulnerability, which was classified as problematic, was found in CodeAstro Patient Record Management System 1.0. Affected is an unknown function. The manipul… |
CVE-2025-52878 | Medium | 4.3 | 2025-06-23 | In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions |
CVE-2025-6478 | Medium | 4.3 | 2025-06-22 | A vulnerability was found in CodeAstro Expense Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality. T… |
CVE-2025-6476 | Medium | 4.3 | 2025-06-22 | A vulnerability was found in SourceCodester Gym Management System 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation… |
CVE-2023-5600 | Low | 3.1 | 2025-06-20 | An issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions… |
CVE-2025-5121 | High | 8.5 | 2025-06-20 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.4 and 18.0 before 18.0.2. A missing authorization check may have al… |
CVE-2025-52802 | High | 7.5 | 2025-06-20 | Missing Authorization vulnerability in enguerranws Import YouTube videos as WP Posts import-youtube-videos-as-wp-post allows Exploiting Incorrectly Configured… |
CVE-2025-50034 | Medium | 6.5 | 2025-06-20 | Missing Authorization vulnerability in Mahmudul Hasan Arif Enhanced Blocks – Page Builder Blocks for Gutenberg enhanced-blocks allows Exploiting Incorrectly Co… |
CVE-2025-50010 | Medium | 5.4 | 2025-06-20 | Missing Authorization vulnerability in Zapier Zapier for WordPress zapier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-50009 | Medium | 5.4 | 2025-06-20 | Missing Authorization vulnerability in Climax Themes Kata Plus kata-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-50008 | Medium | 5.4 | 2025-06-20 | Missing Authorization vulnerability in cscode WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily innovs-woo-mana… |
CVE-2025-49998 | Medium | 5.4 | 2025-06-20 | Missing Authorization vulnerability in Wetail WooCommerce Fortnox Integration woocommerce-fortnox-integration allows Exploiting Incorrectly Configured Access C… |
CVE-2025-49997 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in Syed Balkhi Giveaways and Contests by RafflePress rafflepress allows Accessing Functionality Not Properly Constrained by… |
CVE-2025-49996 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-stats-manager allows Accessing Functionality Not Properly Constra… |
CVE-2025-49993 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in csarturas Cookie-Script.com cookie-script-com allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-49991 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in tggfref WP-Recall allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WP-Recall: from n/… |
CVE-2025-49990 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in contentstudio Contentstudio contentstudio allows Accessing Functionality Not Properly Constrained by ACLs.This issue aff… |
CVE-2025-49989 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in App Cheap App Builder app-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-49988 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in Renzo Johnson Contact Form 7 AWeber Extension integrate-contact-form-7-and-aweber allows Exploiting Incorrectly Configur… |
CVE-2025-49987 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in WPFactory CRM ERP Business Solution crm-erp-business-solution allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-49986 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in thanhtungtnt Video List Manager video-list-manager allows Accessing Functionality Not Properly Constrained by ACLs.This… |
CVE-2025-49982 | Medium | 4.3 | 2025-06-20 | Missing Authorization vulnerability in aguilatechnologies WP Customer Area customer-area allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-49981 | Medium | 4.3 | 2025-06-20 | Missing Authorization vulnerability in mahabub81 User Roles and Capabilities user-roles-and-capabilities allows Exploiting Incorrectly Configured Access Contro… |
CVE-2025-49980 | Medium | 4.3 | 2025-06-20 | Missing Authorization vulnerability in WP Event Manager WP User Profile Avatar wp-user-profile-avatar allows Exploiting Incorrectly Configured Access Control S… |