CWE-862 · Missing Authorization (page 44)
Page 44 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-30398 | High | 8.1 | 2025-11-11 | Missing authorization in Nuance PowerScribe allows an unauthorized attacker to disclose information over a network. |
CVE-2025-33185 | Medium | 5.3 | 2025-11-11 | NVIDIA AIStore contains a vulnerability in AuthN where an unauthenticated user may cause information disclosure. A successful exploit of this vulnerability ma… |
CVE-2025-12953 | Medium | 4.3 | 2025-11-11 | The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a… |
CVE-2025-5317 | Medium | 5.5 | 2025-11-11 | An improper access restriction to a folder in Bitdefender Endpoint Security Tools for Mac (BEST) before 7.20.52.200087 allows local users with administrative p… |
CVE-2025-12665 | Medium | 4.3 | 2025-11-11 | The Ninja Countdown | Fastest Countdown Builder plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ninja… |
CVE-2025-12526 | Medium | 4.3 | 2025-11-11 | The Private Google Calendars plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pgc_remove' acti… |
CVE-2025-11999 | Medium | 5.3 | 2025-11-11 | The Add Multiple Marker plugin for WordPress is vulnerable to unauthorized modification of data to due to a missing capability check on the addmultiplemarker_r… |
CVE-2025-11996 | Medium | 5.3 | 2025-11-11 | The Find Unused Images plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the fui_delete_image() and fui_dele… |
CVE-2025-11988 | Medium | 5.3 | 2025-11-11 | The Crypto plugin for WordPress is vulnerable to unauthorized manipulation of data in all versions up to, and including, 2.22. This is due to the plugin regist… |
CVE-2025-11894 | Medium | 5.3 | 2025-11-11 | The Shelf Planner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints in al… |
CVE-2025-42899 | Medium | 4.3 | 2025-11-11 | SAP S4CORE (Manage journal entries) does not perform necessary authorization checks for an authenticated user resulting in escalation of privileges. This has l… |
CVE-2025-42882 | Medium | 4.3 | 2025-11-11 | Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could execute a specific fun… |
CVE-2025-48878 | Medium | 4.3 | 2025-11-10 | Combodo iTop is a web based IT service management tool. In versions on the 3.x branch prior to 3.2.2, an insecure direct object reference allows a user (e.g. w… |
CVE-2025-64684 | Medium | 4.3 | 2025-11-10 | In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form |
CVE-2025-64681 | Low | 2.7 | 2025-11-10 | In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations |
CVE-2025-12925 | High | 7.3 | 2025-11-10 | A security flaw has been discovered in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. Impacted is the function getAll/addDic/getAllDic/deleteDic… |
CVE-2025-12924 | Medium | 4.3 | 2025-11-10 | A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. This issue affects the function GlobalResult of the file src/mai… |
CVE-2025-11448 | Medium | 4.3 | 2025-11-08 | The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-12498 | Medium | 4.3 | 2025-11-08 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized booking note creation due to a missing capability che… |
CVE-2025-7663 | Medium | 6.5 | 2025-11-08 | The Ovatheme Events Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the /class-ovae… |
CVE-2025-12167 | Medium | 4.3 | 2025-11-08 | The Contact Form 7 AWeber Extension plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_a… |
CVE-2025-12042 | Medium | 5.3 | 2025-11-08 | The Course Booking System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in the csv-export.php file in all… |
CVE-2025-12583 | Medium | 6.4 | 2025-11-08 | The Simple Downloads List plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_neofix_sdl_… |
CVE-2025-12527 | Medium | 4.3 | 2025-11-07 | The Page & Post Notes plugin for WordPress is vulnerable to unauthorized modification of notes due to a missing capability check on the 'yydev_notes_save_dashb… |
CVE-2025-4522 | Medium | 6.5 | 2025-11-07 | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the admin_post_don… |
CVE-2025-64323 | Medium | 5.3 | 2025-11-07 | kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.4 and below and 2.1.0-agw-cel-rbac through 2.1.0-rc.2 lack authentication, allowing any client with… |
CVE-2025-5483 | High | 8.1 | 2025-11-07 | The LC Wizard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check in the ghl-wizard/inc/wp_user.php file in versions 1… |
CVE-2025-64179 | Medium | 5.3 | 2025-11-06 | lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authentication in the /api/v1/… |
CVE-2025-62914 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in anibalwainstein Effect Maker effect-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-62049 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder.This issue affects Cost Calculator Builder: from n/a through <=… |
CVE-2025-62046 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in CodexThemes TheGem Demo Import (for WPBakery) thegem-importer.This issue affects TheGem Demo Import (for WPBakery): from… |
CVE-2025-62037 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4. |
CVE-2025-62033 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4. |
CVE-2025-62028 | Medium | 4.3 | 2025-11-06 | Missing Authorization vulnerability in ThemeNectar Salient salient.This issue affects Salient: from n/a through < 17.4.0. |
CVE-2025-62018 | Medium | 5.3 | 2025-11-06 | Missing Authorization vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through <= 4.22.0. |
CVE-2025-62017 | Medium | 5.4 | 2025-11-06 | Missing Authorization vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through <= 4.22.0. |
CVE-2025-60247 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in Bux Bux Woocommerce bux-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects B… |
CVE-2025-5803 | Medium | 5.3 | 2025-11-06 | Missing Authorization vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking.This issue affects VikBooking Hotel Booking Engine & PMS: from… |
CVE-2025-58986 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in ganddser Jock On Air Now (JOAN) joan allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-58629 | High | 7.5 | 2025-11-06 | Missing Authorization vulnerability in kamleshyadav Miraculous miraculous allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-58243 | Medium | 5.3 | 2025-11-06 | Missing Authorization vulnerability in Jthemes imEvent imevent allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects imEvent: from… |
CVE-2025-58207 | High | 8.2 | 2025-11-06 | Missing Authorization vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-generator-for-wp allows Exploiting Incorrectly Configure… |
CVE-2025-54711 | High | 7.1 | 2025-11-06 | Missing Authorization vulnerability in bPlugins Info Cards info-cards allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Info C… |
CVE-2025-53246 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in Gaurav Aggarwal Backup and Move backup-and-move allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-53214 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in sertifier Sertifier Certificate & Badge Maker sertifier-certificates-open-badges allows Exploiting Incorrectly Configure… |
CVE-2025-49394 | High | 7.1 | 2025-11-06 | Missing Authorization vulnerability in bPlugins Image Gallery block – Create and display photo gallery/photo album. 3d-image-gallery allows Accessing Functiona… |
CVE-2025-39465 | Medium | 4.3 | 2025-11-06 | Missing Authorization vulnerability in flippercode Advanced Google Maps wp-google-map-gold allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-12563 | Medium | 4.3 | 2025-11-06 | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to limited file upload due to an incorrect capability check on theupload… |
CVE-2025-64171 | | 2025-11-06 | MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-namespace secret access vulnerability in… | |
CVE-2025-12469 | Medium | 4.3 | 2025-11-05 | The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all v… |
CVE-2025-12675 | Medium | 4.3 | 2025-11-05 | The KiotViet Sync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveConfig() function in all… |
CVE-2025-12384 | High | 8.6 | 2025-11-05 | The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to unauthorized access/modification/loss of data in all ver… |
CVE-2025-11373 | Medium | 4.3 | 2025-11-05 | The Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel plugin fo… |
CVE-2025-11835 | Medium | 5.3 | 2025-11-05 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modific… |
CVE-2025-12582 | Medium | 4.3 | 2025-11-05 | The Features plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'features_revert_option AJAX endp… |
CVE-2025-63294 | Medium | 6.5 | 2025-11-04 | WorkDo HRM SaaS HR and Payroll Tool 8.1 is affected vulnerable to Insecure Permissions. An authenticated user can create leave or resignation records on behalf… |
CVE-2025-41345 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41344 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41343 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41342 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41341 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41340 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41339 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41338 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41337 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41336 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41335 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41114 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41113 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41112 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41111 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-12389 | Medium | 4.3 | 2025-11-04 | The Import Export For WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_setti… |
CVE-2025-12350 | Medium | 5.3 | 2025-11-04 | The DominoKit plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wp_ajax_nopriv_dominokit_option_admin_action A… |
CVE-2025-12158 | Critical | 9.8 | 2025-11-04 | The Simple User Capabilities plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the suc_submit_capabilities() func… |
CVE-2025-12157 | Medium | 5.3 | 2025-11-04 | The Simple User Capabilities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_nopriv_r… |
CVE-2025-12156 | Medium | 4.3 | 2025-11-04 | The Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin for WordPress is vulnerable to unauthorized modification of data due to… |
CVE-2025-11890 | High | 7.5 | 2025-11-04 | The Crypto Payment Gateway with Payeer for WooCommerce plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 1.0.3. This i… |
CVE-2025-11758 | Medium | 6.5 | 2025-11-04 | The All in One Time Clock Lite plugin for WordPress is vulnerable to unauthorized access due to a missing authorization check in all versions up to, and includ… |
CVE-2025-10896 | High | 8.8 | 2025-11-04 | Multiple plugins for WordPress with the Jewel Theme Recommended Plugins Library are vulnerable to Unrestricted Upload of File with Dangerous Type via arbitrary… |
CVE-2025-63293 | Medium | 6.5 | 2025-11-03 | FairSketch Rise Ultimate Project Manager & CRM 3.9.4 is vulnerable to Insecure Permissions. A remote authenticated user can append comments or upload attachmen… |
CVE-2025-64294 | Medium | 5.3 | 2025-11-03 | Missing Authorization vulnerability in d3wp WP Snow Effect wp-snow-effect allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP… |
CVE-2025-36367 | High | 8.8 | 2025-11-01 | IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 is vulnerable to privilege escalation caused by an invalid IBM i SQL services authorization check. A malicious actor can use… |
CVE-2025-12180 | Medium | 4.3 | 2025-11-01 | The Qi Blocks plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.3. This is due to the plugin storing arbitr… |
CVE-2025-11833 | Critical | 9.8 | 2025-11-01 | The Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a m… |
CVE-2025-11816 | Medium | 5.3 | 2025-11-01 | The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized modification of… |
CVE-2025-64349 | High | 8.8 | 2025-10-31 | ELOG allows an authenticated user to modify another user's profile. An attacker can edit a target user's email address, then request a password reset, and take… |
CVE-2025-64348 | High | 7.1 | 2025-10-31 | ELOG allows an authenticated user to modify or overwrite the configuration file, resulting in denial of service. If the execute facility is specifically enable… |
CVE-2025-64358 | Medium | 4.3 | 2025-10-31 | Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce wt-smart-coupons-for-woocommerce allows Exploiting Incorrectly Configured Access… |
CVE-2025-64356 | Medium | 4.3 | 2025-10-31 | Missing Authorization vulnerability in f1logic Insert PHP Code Snippet insert-php-code-snippet allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-64352 | Low | 2.7 | 2025-10-31 | Missing Authorization vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Exploiting Incorrectly Configured… |
CVE-2025-64350 | Low | 3.8 | 2025-10-31 | Missing Authorization vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-12041 | Medium | 5.3 | 2025-10-31 | The ERI File Library plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'erifl_file' AJAX action in all… |
CVE-2025-12175 | Medium | 4.3 | 2025-10-31 | The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'tec_qr_code_modal' AJAX endpoint in… |
CVE-2025-11191 | Medium | 5.3 | 2025-10-31 | The RealPress WordPress plugin before 1.1.0 registers the REST routes without proper permission checks, allowing the creation of pages and sending of emails f… |
CVE-2025-11975 | Medium | 4.3 | 2025-10-31 | The FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) plugin for WordPress is vulnerable to… |
CVE-2024-13994 | Critical | 9.8 | 2025-10-30 | Nagios XI versions prior to 2024R1.1.2 contain a missing authorization control when the 'Allow Insecure Logins' option is enabled. Under this configuration, an… |
CVE-2023-7317 | High | 8.8 | 2025-10-30 | Nagios XI versions prior to 2024R1 contain a missing access control vulnerability via the Web SSH Terminal. A remote, low-privileged attacker could access or i… |
CVE-2013-10072 | Medium | 6.5 | 2025-10-30 | Nagios XI versions prior to 2012R1.6 contain an authorization flaw in the Auto-Discovery functionality. Users with read-only roles could directly reach Auto-Di… |
CVE-2025-62712 | Critical | 9.6 | 2025-10-30 | JumpServer is an open source bastion host and an operation and maintenance security audit system. In JumpServer versions prior to v3.10.20-lts and v4.10.11-lts… |
CVE-2025-11881 | Medium | 5.3 | 2025-10-30 | The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'myappp_verify… |