CWE-862 · Missing Authorization (page 42)
Page 42 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-47709 | Medium | 6.5 | 2025-05-14 | Missing Authorization vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Forceful Browsing.This issue affects Enterprise MFA - TFA for Drupal: from… |
CVE-2025-24021 | Medium | 5.0 | 2025-05-14 | iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can set value to objec… |
CVE-2025-4430 | | 2025-05-14 | Unauthorized access to "/api/Token/gettoken" endpoint in EZD RP allows file manipulation.This issue affects EZD RP in versions before 20.19 (published on 22nd… | |
CVE-2025-4520 | Medium | 5.4 | 2025-05-14 | The Uncanny Automator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in v… |
CVE-2025-4339 | Medium | 4.3 | 2025-05-13 | The TheGem theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxApi() function in all versions u… |
CVE-2025-43011 | High | 7.7 | 2025-05-13 | Under certain conditions, SAP Landscape Transformation's PCL Basis module does not perform the necessary authorization checks, allowing authenticated users to… |
CVE-2025-43009 | Medium | 6.3 | 2025-05-13 | SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This… |
CVE-2025-43008 | Medium | 5.8 | 2025-05-13 | Due to missing authorization check, an unauthorized user can view the files of other company. This might lead to disclosure of personal data of employees. Ther… |
CVE-2025-43007 | Medium | 6.3 | 2025-05-13 | SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This… |
CVE-2025-43004 | Medium | 5.3 | 2025-05-13 | Due to a security misconfiguration vulnerability, customers can develop Production Operator Dashboards (PODs) that enable outside users to access customer data… |
CVE-2025-43000 | High | 7.9 | 2025-05-13 | Under certain conditions Promotion Management Wizard (PMW) allows an attacker to access information which would otherwise be restricted.This has High impact on… |
CVE-2025-30448 | Critical | 9.1 | 2025-05-12 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.4, macOS Sonoma 1… |
CVE-2025-46745 | Medium | 6.5 | 2025-05-12 | An authenticated user without user-management permissions could view other users account information. |
CVE-2025-26846 | Critical | 9.8 | 2025-05-12 | An issue was discovered in Znuny before 7.1.4. Permissions are not checked properly when using the Generic Interface to update ticket metadata. |
CVE-2025-3876 | High | 8.8 | 2025-05-10 | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to insufficient user OTP validation in the handl… |
CVE-2025-28202 | High | 8.8 | 2025-05-09 | Incorrect access control in Victure RX1800 EN_V1.0.0_r12_110933 allows attackers to enable SSH and Telnet services without authentication. |
CVE-2025-3949 | Medium | 4.3 | 2025-05-09 | The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized ac… |
CVE-2025-20164 | High | 8.3 | 2025-05-07 | A vulnerability in the Cisco Industrial Ethernet Switch Device Manager (DM) of Cisco IOS Software could allow an authenticated, remote attacker to elevate priv… |
CVE-2025-47692 | Medium | 4.3 | 2025-05-07 | Missing Authorization vulnerability in contentstudio Contentstudio contentstudio allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-47688 | Medium | 5.3 | 2025-05-07 | Missing Authorization vulnerability in Saad Iqbal Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-47628 | Medium | 5.4 | 2025-05-07 | Missing Authorization vulnerability in quomodosoft QS Dark Mode qs-dark-mode allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-47612 | Medium | 5.4 | 2025-05-07 | Missing Authorization vulnerability in ClickWhale ClickWhale clickwhale allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-47602 | Medium | 5.4 | 2025-05-07 | Missing Authorization vulnerability in ammarahmad786 Calculate Prices based on Distance For WooCommerce calculate-prices-based-on-distance-for-woocommerce allo… |
CVE-2025-47591 | Medium | 4.3 | 2025-05-07 | Missing Authorization vulnerability in CreedAlly Bulk Featured Image bulk-featured-image allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-47528 | Medium | 4.3 | 2025-05-07 | Missing Authorization vulnerability in pewilliams Ovation Elements ovation-elements allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-47526 | Medium | 5.4 | 2025-05-07 | Missing Authorization vulnerability in GS Plugins GS Variation Swatches for WooCommerce gs-woo-variation-swatches allows Exploiting Incorrectly Configured Acce… |
CVE-2025-47486 | Medium | 5.3 | 2025-05-07 | Missing Authorization vulnerability in CyberChimps Responsive Plus responsive-add-ons allows Accessing Functionality Not Properly Constrained by ACLs.This issu… |
CVE-2025-47485 | Medium | 5.3 | 2025-05-07 | Missing Authorization vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-47480 | Medium | 5.4 | 2025-05-07 | Missing Authorization vulnerability in Iqonic Design Graphina graphina-elementor-charts-and-graphs allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-47472 | Medium | 5.4 | 2025-05-07 | Missing Authorization vulnerability in codepeople Music Player for WooCommerce music-player-for-woocommerce allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-47471 | Medium | 4.3 | 2025-05-07 | Missing Authorization vulnerability in EnvoThemes Envo Extra envo-extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-47469 | Medium | 5.4 | 2025-05-07 | Missing Authorization vulnerability in slui Media Hygiene media-hygiene allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-47467 | Medium | 4.3 | 2025-05-07 | Missing Authorization vulnerability in GS Plugins GS Testimonial Slider gs-testimonial allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-47465 | Medium | 4.9 | 2025-05-07 | Missing Authorization vulnerability in creativethemeshq Blocksy blocksy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-47457 | Medium | 5.3 | 2025-05-07 | Missing Authorization vulnerability in dgamoni LocateAndFilter locateandfilter allows Accessing Functionality Not Properly Constrained by ACLs.This issue affec… |
CVE-2025-47450 | Medium | 5.3 | 2025-05-07 | Missing Authorization vulnerability in Mitchell Bennis Simple File List simple-file-list allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-3766 | Medium | 5.4 | 2025-05-07 | The Login Lockdown & Protection plugin for WordPress is vulnerable to unauthorized nonce access due to a missing capability check on the ajax_run_tool function… |
CVE-2025-2821 | Medium | 5.3 | 2025-05-07 | The Search Exclude plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_rest_permission functio… |
CVE-2025-0856 | High | 7.3 | 2025-05-06 | The PGS Core plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions… |
CVE-2025-4327 | Medium | 4.3 | 2025-05-06 | A vulnerability was found in MRCMS 3.1.2. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request… |
CVE-2025-46586 | Medium | 5.1 | 2025-05-06 | Permission control vulnerability in the contacts module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-4282 | Medium | 4.3 | 2025-05-05 | A vulnerability has been found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as problematic. This vulnerability affects unknown code o… |
CVE-2025-3927 | Critical | 9.8 | 2025-05-02 | Digigram's PYKO-OUT audio-over-IP (AoIP) web-server does not require a password by default, allowing any attacker with the target IP address to connect and com… |
CVE-2025-1326 | Medium | 4.3 | 2025-05-02 | The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homey_reservation_del() function in a… |
CVE-2024-13420 | Medium | 4.3 | 2025-05-02 | Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_se… |
CVE-2024-13419 | Medium | 6.4 | 2025-05-02 | Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability check on the saveO… |
CVE-2025-4179 | High | 7.3 | 2025-05-02 | The Flynax Bridge plugin for WordPress is vulnerable to limited Privilege Escalation due to a missing capability check on the registerUser() function in all ve… |
CVE-2025-4177 | Medium | 5.3 | 2025-05-02 | The Flynax Bridge plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteUser() function in all version… |
CVE-2025-3746 | Critical | 9.8 | 2025-05-02 | The OTP-less one tap Sign in plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.14 to 2.0.59. This is due to the p… |
CVE-2025-3952 | High | 8.1 | 2025-05-01 | The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due… |
CVE-2025-1304 | High | 8.8 | 2025-05-01 | The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and_activate_plugin()… |
CVE-2025-2816 | High | 8.1 | 2025-05-01 | The Page View Count plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability ch… |
CVE-2025-46557 | Critical | 9.8 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 15.3-rc-1 to before 15.10.14, from 16.0.0-rc-1 to before 16.4.6, and from 16.5.0-rc-1 to before 16… |
CVE-2025-46554 | Medium | 5.3 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 1.8.1 to before 14.10.22, from 15.0-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and… |
CVE-2025-39413 | Medium | 4.3 | 2025-04-30 | Missing Authorization vulnerability in David Gwyer Simple Sitemap – Create a Responsive HTML Sitemap simple-sitemap.This issue affects Simple Sitemap – Create… |
CVE-2025-21416 | High | 8.5 | 2025-04-30 | Missing authorization in Azure Virtual Desktop allows an authorized attacker to elevate privileges over a network. |
CVE-2025-32973 | Critical | 9.0 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16… |
CVE-2025-3953 | Medium | 5.4 | 2025-04-30 | The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing… |
CVE-2025-46348 | Critical | 10.0 | 2025-04-29 | YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication… |
CVE-2025-4095 | | 2025-04-29 | Registry Access Management (RAM) is a security feature allowing administrators to restrict access for their developers to only allowed registries. When a MacOS… | |
CVE-2025-4064 | Medium | 5.3 | 2025-04-29 | A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/vie… |
CVE-2025-3452 | Medium | 4.3 | 2025-04-29 | The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'secup… |
CVE-2025-39367 | Medium | 5.3 | 2025-04-28 | Missing Authorization vulnerability in SeventhQueen Kleo kleo.This issue affects Kleo: from n/a through < 5.4.4. |
CVE-2025-3997 | Medium | 4.3 | 2025-04-28 | A vulnerability classified as problematic has been found in dazhouda lecms 3.0.3. This affects an unknown part of the file /index.php?my-profile-ajax-1 of the… |
CVE-2025-3981 | Medium | 4.3 | 2025-04-27 | A vulnerability, which was classified as problematic, has been found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0. This issue affects some u… |
CVE-2025-3980 | Medium | 4.3 | 2025-04-27 | A vulnerability classified as problematic was found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0. This vulnerability affects unknown code of… |
CVE-2025-3979 | Medium | 4.3 | 2025-04-27 | A vulnerability classified as problematic has been found in dazhouda lecms 3.0.3. This affects an unknown part of the file /index.php?my-password-ajax-1 of the… |
CVE-2025-3977 | Medium | 4.3 | 2025-04-27 | A vulnerability was found in iteachyou Dreamer CMS up to 4.1.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2025-3964 | Medium | 4.3 | 2025-04-27 | A vulnerability, which was classified as problematic, was found in withstars Books-Management-System 1.0. Affected is an unknown function of the file /api/arti… |
CVE-2025-3963 | High | 7.3 | 2025-04-27 | A vulnerability, which was classified as critical, has been found in withstars Books-Management-System 1.0. This issue affects some unknown processing of the f… |
CVE-2025-3960 | High | 7.3 | 2025-04-27 | A vulnerability was found in withstars Books-Management-System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the… |
CVE-2025-3959 | Medium | 4.3 | 2025-04-27 | A vulnerability was found in withstars Books-Management-System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functiona… |
CVE-2025-3915 | Medium | 4.3 | 2025-04-26 | The Aeropage Sync for Airtable plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'aeropageDeletePost' fu… |
CVE-2025-3906 | High | 8.8 | 2025-04-26 | The Integração entre Eduzz e Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wep_… |
CVE-2025-43862 | High | 7.6 | 2025-04-25 | Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web… |
CVE-2025-32045 | Medium | 5.3 | 2025-04-25 | A flaw has been identified in Moodle where insufficient capability checks in certain grade reports allowed users without the necessary permissions to access hi… |
CVE-2025-3912 | Medium | 5.3 | 2025-04-25 | The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability… |
CVE-2025-1279 | High | 8.8 | 2025-04-25 | The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capabilit… |
CVE-2025-46535 | Medium | 5.4 | 2025-04-25 | Missing Authorization vulnerability in AlphaEfficiencyTeam Custom Login and Registration allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-46519 | Medium | 4.3 | 2025-04-24 | Missing Authorization vulnerability in M.Code Media Library Downloader media-library-downloader allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-46489 | Medium | 5.3 | 2025-04-24 | Missing Authorization vulnerability in vinodvaswani9 Bulk Assign Linked Products For WooCommerce wc-bulk-assign-linked-products allows Accessing Functionality… |
CVE-2025-46485 | Medium | 5.3 | 2025-04-24 | Missing Authorization vulnerability in Carlo La Pera WP Customize Login Page wp-customize-login-page allows Accessing Functionality Not Properly Constrained by… |
CVE-2025-46470 | Medium | 4.3 | 2025-04-24 | Missing Authorization vulnerability in Peter Raschendorfer Smart Hashtags [#hashtagger] hashtagger allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-39390 | Medium | 5.3 | 2025-04-24 | Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Accessing Functionality Not… |
CVE-2025-39385 | Medium | 4.3 | 2025-04-24 | Missing Authorization vulnerability in vowelweb Sirat sirat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sirat: f… |
CVE-2021-47662 | High | 7.5 | 2025-04-24 | Due to missing authorization an unauthenticated remote attacker can cause a DoS attack by connecting via HTTPS and triggering the shutdown button. |
CVE-2025-3604 | Critical | 9.8 | 2025-04-24 | The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0. This is due to t… |
CVE-2025-3058 | High | 8.8 | 2025-04-24 | The Xelion Webchat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability ch… |
CVE-2024-13307 | Medium | 5.3 | 2025-04-24 | The Reales WP - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check o… |
CVE-2024-12244 | Medium | 4.3 | 2025-04-24 | An issue has been discovered in access controls could allow users to view certain restricted project information even when related features are disabled in Git… |
CVE-2025-1021 | High | 7.5 | 2025-04-23 | Missing authorization vulnerability in synocopy in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows remote attac… |
CVE-2025-37087 | Critical | 9.8 | 2025-04-22 | A vulnerability in the cmdb service of the HPE Performance Cluster Manager (HPCM) could allow an attacker to gain access to an arbitrary file on the server hos… |
CVE-2025-46247 | Medium | 5.3 | 2025-04-22 | Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Accessing Functionality Not Properly Constra… |
CVE-2025-46244 | Medium | 5.3 | 2025-04-22 | Missing Authorization vulnerability in Dotstore Advanced Linked Variations for Woocommerce linked-variation allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-46232 | Medium | 4.3 | 2025-04-22 | Missing Authorization vulnerability in alttextai Download Alt Text AI alttext-ai allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-3843 | Medium | 4.3 | 2025-04-21 | A vulnerability was found in panhainan DS-Java 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-sit… |
CVE-2025-28103 | Medium | 6.4 | 2025-04-21 | Incorrect access control in laskBlog v2.6.1 allows attackers to arbitrarily delete user accounts via a crafted request. |
CVE-2025-2298 | | 2025-04-21 | An improper authorization vulnerability in Dremio Software allows authenticated users to delete arbitrary files that the system has access to, including system… | |
CVE-2025-3808 | Medium | 4.3 | 2025-04-19 | A vulnerability has been found in zhenfeng13 My-BBS 1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross… |
CVE-2024-53591 | Critical | 9.8 | 2025-04-18 | An issue in the login page of Seclore v3.27.5.0 allows attackers to bypass authentication via a brute force attack. |