CWE-862 · Missing Authorization (page 46)
Page 46 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-29926 | Critical | 9.8 | 2025-03-19 | XWiki Platform is a generic wiki platform. Prior to 15.10.15, 16.4.6, and 16.10.0, any user can exploit the WikiManager REST API to create a new wiki, where th… |
CVE-2024-12920 | High | 8.8 | 2025-03-19 | The FoodBakery | Delivery Restaurant Directory WordPress Theme theme for WordPress is vulnerable to unauthorized access of data and modification of data due to… |
CVE-2024-13412 | High | 7.5 | 2025-03-19 | The CozyStay theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handler function in all versi… |
CVE-2024-12922 | Critical | 9.8 | 2025-03-19 | The Altair theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check withi… |
CVE-2025-2290 | Medium | 5.3 | 2025-03-19 | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability… |
CVE-2025-30107 | High | 7.5 | 2025-03-18 | On IROAD V9 devices, Managing Settings and Obtaining Sensitive Data and Sabotaging the Car Battery can be performed by unauthorized parties. A vulnerability in… |
CVE-2025-2262 | High | 7.3 | 2025-03-18 | The The Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation plugin for WordPress is vulnerable to arbitrary shortcode executi… |
CVE-2025-2420 | Medium | 4.3 | 2025-03-17 | A vulnerability classified as problematic was found in 猫宁i Morning up to bc782730c74ff080494f145cc363a0b4f43f7d3e. Affected by this vulnerability is an unknown… |
CVE-2025-26969 | High | 8.3 | 2025-03-15 | Missing Authorization vulnerability in Aldo Latino PrivateContent. This issue affects PrivateContent: from n/a through 8.11.5. |
CVE-2025-26961 | High | 8.6 | 2025-03-15 | Missing Authorization vulnerability in FRESHFACE Fresh Framework fresh-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue aff… |
CVE-2025-2025 | Medium | 6.5 | 2025-03-15 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on th… |
CVE-2025-2267 | Medium | 6.5 | 2025-03-15 | The WP01 plugin for WordPress is vulnerable to Arbitrary File Download in all versions up to, and including, 2.6.2 due to a missing capability check and insuff… |
CVE-2025-1668 | Medium | 4.3 | 2025-03-15 | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to arbitrary user deletion due to a missing capability check on the wpsp_Delete… |
CVE-2025-1667 | High | 8.8 | 2025-03-15 | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wpsp_UpdateTea… |
CVE-2024-12336 | Medium | 6.5 | 2025-03-15 | The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check… |
CVE-2025-1657 | High | 8.8 | 2025-03-15 | The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to unauthorized modification of data and PHP Object Injection due to a mi… |
CVE-2024-12810 | High | 8.8 | 2025-03-14 | The JobCareer | Job Board Responsive WordPress Theme theme for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing… |
CVE-2025-1507 | Medium | 5.3 | 2025-03-14 | The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the h… |
CVE-2025-2289 | Medium | 4.3 | 2025-03-14 | The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX endpoints in all… |
CVE-2025-2103 | High | 8.8 | 2025-03-14 | The SoundRise Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability c… |
CVE-2025-0952 | High | 8.1 | 2025-03-14 | The Eco Nature - Environment & Ecology WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of serv… |
CVE-2025-1528 | Medium | 4.3 | 2025-03-14 | The Search & Filter Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_meta_values' function i… |
CVE-2025-1285 | Medium | 5.3 | 2025-03-14 | The Resido - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the delete_api_key and s… |
CVE-2025-0955 | Medium | 5.3 | 2025-03-14 | The VidoRev Extensions plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'vidorev_import_single_video' AJAX ac… |
CVE-2025-27103 | Medium | 6.5 | 2025-03-13 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass for the patch for CVE-2024-55953 allows authent… |
CVE-2025-24974 | Medium | 6.5 | 2025-03-13 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, authenticated users can read and deserialize arbitrary f… |
CVE-2025-2104 | Medium | 4.3 | 2025-03-13 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to unauthorized post publication due to insufficient validation… |
CVE-2024-13703 | Medium | 4.3 | 2025-03-13 | The CRM and Lead Management by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_aja… |
CVE-2025-1508 | Medium | 5.3 | 2025-03-12 | The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_data action in all vers… |
CVE-2025-28938 | Medium | 4.3 | 2025-03-11 | Missing Authorization vulnerability in Bjoern WP Performance Pack wp-performance-pack allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-28920 | Medium | 5.3 | 2025-03-11 | Missing Authorization vulnerability in Jogesh Responsive Google Map responsive-google-map allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-28872 | Medium | 5.3 | 2025-03-11 | Missing Authorization vulnerability in jwpegram Block Spam By Math Reloaded block-spam-by-math-reloaded allows Accessing Functionality Not Properly Constrained… |
CVE-2025-27432 | Low | 2.4 | 2025-03-11 | The eDocument Cockpit (Inbound NF-e) in SAP Electronic Invoicing for Brazil allows an authenticated attacker with certain privileges to gain unauthorized acces… |
CVE-2025-26661 | High | 8.8 | 2025-03-11 | Due to missing authorization check, SAP NetWeaver (ABAP Class Builder) allows an attacker to gain higher access levels than they should have, resulting in esca… |
CVE-2025-26656 | Medium | 4.3 | 2025-03-11 | OData Service in Manage Purchasing Info Records does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate pri… |
CVE-2025-26655 | Low | 3.1 | 2025-03-11 | SAP Just In Time(JIT) does not perform necessary authorization checks for an authenticated user, allowing attacker to escalate privileges that would otherwise… |
CVE-2025-25244 | Medium | 5.7 | 2025-03-11 | SAP Business Warehouse (Process Chains) allows an attacker to manipulate the process execution due to missing authorization check. An attacker with display aut… |
CVE-2025-23188 | Medium | 4.3 | 2025-03-11 | An authenticated user with low privileges can exploit a missing authorization check in an IBS module of FS-RBD, allowing unauthorized access to perform actions… |
CVE-2024-10326 | Medium | 4.3 | 2025-03-08 | The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_options an… |
CVE-2025-1325 | Medium | 6.3 | 2025-03-08 | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to arbitrary shortcode execution due to a missing capability check on… |
CVE-2024-13816 | Medium | 5.4 | 2025-03-08 | The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to unauthorized access, mod… |
CVE-2025-1504 | Medium | 4.3 | 2025-03-08 | The Post Lockdown plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.0.2 via the 'pl_autocomplete' AJAX action… |
CVE-2025-1481 | Medium | 6.5 | 2025-03-08 | The Shortcode Cleaner Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_backup() functio… |
CVE-2024-12876 | Critical | 9.8 | 2025-03-07 | The Golo - City Travel Guide WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and includin… |
CVE-2024-12611 | Medium | 5.3 | 2025-03-07 | The School Management System for Wordpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to… |
CVE-2024-12610 | Medium | 5.3 | 2025-03-07 | The School Management System for Wordpress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'mj_smgt_re… |
CVE-2025-1309 | High | 8.8 | 2025-03-07 | The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data that can lead t… |
CVE-2024-13655 | High | 8.1 | 2025-03-07 | The Flex Mag - Responsive WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due… |
CVE-2024-13526 | Medium | 4.3 | 2025-03-07 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on… |
CVE-2025-2042 | Medium | 4.3 | 2025-03-06 | A vulnerability has been found in huang-yk student-manage 1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to… |
CVE-2025-1666 | Medium | 4.3 | 2025-03-06 | The Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing… |
CVE-2024-13423 | Medium | 5.3 | 2025-03-05 | The Sparkling theme for WordPress is vulnerable to unauthorized plugin activation/deactivation due to a missing capability check on the 'sparkling_activate_plu… |
CVE-2025-0954 | Medium | 6.5 | 2025-03-05 | The WP Online Contract plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the json_import() and json_export() funct… |
CVE-2024-13811 | Medium | 4.3 | 2025-03-05 | The Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability c… |
CVE-2024-13810 | Medium | 4.3 | 2025-03-05 | The Zass - WooCommerce Theme for Handmade Artists and Artisans theme for WordPress is vulnerable to unauthorized access due to a missing capability check on th… |
CVE-2024-13780 | Medium | 6.5 | 2025-03-05 | The Hero Mega Menu - Responsive WordPress Menu Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in… |
CVE-2024-13747 | Medium | 4.3 | 2025-03-05 | The WooMail - WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'template_d… |
CVE-2024-13232 | High | 8.8 | 2025-03-05 | The WordPress Awesome Import & Export Plugin - Import & Export WordPress Data plugin for WordPress is vulnerable arbitrary SQL Execution and privilege escalati… |
CVE-2024-8682 | Medium | 5.3 | 2025-03-05 | The JNews - WordPress Newspaper Magazine Blog AMP Theme theme for WordPress is vulnerable to unauthorized user registration in all versions up to, and includin… |
CVE-2025-27666 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Authorization Checks OVE-20230524-0010. |
CVE-2025-1307 | Critical | 9.8 | 2025-03-04 | The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_activate_plugin() fu… |
CVE-2025-1639 | High | 8.8 | 2025-03-04 | The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on th… |
CVE-2024-13686 | Medium | 4.3 | 2025-03-04 | The VW Storefront theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vw_storefront_reset_all_setti… |
CVE-2025-1891 | Medium | 4.3 | 2025-03-04 | A vulnerability was found in shishuocms 1.1 and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site req… |
CVE-2025-27270 | Critical | 9.8 | 2025-03-03 | Missing Authorization vulnerability in enituretechnology Residential Address Detection residential-address-detection allows Privilege Escalation.This issue aff… |
CVE-2025-23763 | Medium | 6.5 | 2025-03-03 | Missing Authorization vulnerability in Alex Volkov WAH Forms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WAH Fo… |
CVE-2025-23615 | Medium | 6.5 | 2025-03-03 | Missing Authorization vulnerability in gtekelis Interactive Page Hierarchy interactive-page-hierarchy allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-23613 | Medium | 6.5 | 2025-03-03 | Missing Authorization vulnerability in mediabeta WP Journal wpjournal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-23515 | Medium | 6.5 | 2025-03-03 | Missing Authorization vulnerability in tsecher ts-tree ts-tree allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ts-tr… |
CVE-2025-23440 | Medium | 6.3 | 2025-03-03 | Missing Authorization vulnerability in radicaldesigns radSLIDE radslide allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-24654 | High | 7.1 | 2025-03-03 | Missing Authorization vulnerability in SEO Squirrly SEO Plugin by Squirrly SEO squirrly-seo.This issue affects SEO Plugin by Squirrly SEO: from n/a through <=… |
CVE-2025-27583 | Critical | 9.1 | 2025-03-03 | Incorrect access control in the component /rest/staffResource/findAllUsersAcrossOrg of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) Eag… |
CVE-2025-25953 | Medium | 6.5 | 2025-03-03 | Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 was discovered to contain an Azure JWT access token exposure. This vulnera… |
CVE-2025-1813 | Medium | 4.3 | 2025-03-02 | A vulnerability classified as problematic was found in zj1983 zz up to 2024-08. Affected by this vulnerability is an unknown functionality. The manipulation le… |
CVE-2025-1404 | Medium | 5.3 | 2025-03-01 | The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t… |
CVE-2024-12544 | High | 8.8 | 2025-03-01 | The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to arbitrary fi… |
CVE-2025-1502 | Medium | 5.3 | 2025-03-01 | The IP2Location Redirection plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'download_ip2location_re… |
CVE-2024-13746 | Medium | 6.5 | 2025-03-01 | The Booking Calendar and Notification plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability check… |
CVE-2025-1780 | Medium | 4.3 | 2025-03-01 | The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing c… |
CVE-2024-13358 | Medium | 4.3 | 2025-03-01 | The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing c… |
CVE-2024-10860 | Medium | 4.3 | 2025-02-28 | The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized submission of data due to a missing capability check on t… |
CVE-2024-9195 | High | 8.8 | 2025-02-28 | The WHMPress - WHMCS Client Area plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing… |
CVE-2024-13716 | Medium | 4.3 | 2025-02-28 | The Forex Calculators plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_settings_callback()… |
CVE-2025-1682 | High | 8.8 | 2025-02-28 | The Cardealer theme for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.4 due to missing capability check on the 'save_se… |
CVE-2025-1681 | Medium | 5.4 | 2025-02-28 | The Cardealer theme for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check and missing filename sa… |
CVE-2025-1745 | Medium | 4.3 | 2025-02-27 | A vulnerability has been found in LinZhaoguan pb-cms 2.0 and classified as problematic. This vulnerability affects unknown code of the component Logout. The ma… |
CVE-2025-22280 | High | 7.6 | 2025-02-27 | Missing Authorization vulnerability in revmakx DefendWP Firewall defend-wp-firewall allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-1249 | Medium | 5.3 | 2025-02-26 | Missing Authorization vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-1091 | Medium | 4.3 | 2025-02-26 | A Broken Authorization schema exists where any authenticated user could download IOA script and configuration files if the URL is known. |
CVE-2025-27000 | Medium | 5.4 | 2025-02-25 | Missing Authorization vulnerability in George Pattichis Simple Photo Feed simple-photo-feed allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-26995 | Medium | 5.4 | 2025-02-25 | Missing Authorization vulnerability in Anton Vanyukov Market Exporter market-exporter allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-26983 | Medium | 4.3 | 2025-02-25 | Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor recipe-card-blocks-by-wpzoom allows Exploiting Incorrectly Configure… |
CVE-2025-26975 | Medium | 5.3 | 2025-02-25 | Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Accessing Functionality Not Properly Constrained by ACLs.This is… |
CVE-2025-26960 | Medium | 6.5 | 2025-02-25 | Missing Authorization vulnerability in enituretechnology Small Package Quotes – Unishippers Edition small-package-quotes-unishippers-edition allows Exploiting… |
CVE-2025-26948 | Medium | 4.3 | 2025-02-25 | Missing Authorization vulnerability in NotFound Pie Register Premium. This issue affects Pie Register Premium: from n/a through 3.8.3.2. |
CVE-2025-26928 | Medium | 4.3 | 2025-02-25 | Missing Authorization vulnerability in Xfinitysoft Order Limit for WooCommerce wc-order-limit-lite allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-26871 | Medium | 4.3 | 2025-02-25 | Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2024-13693 | Medium | 5.3 | 2025-02-25 | The Enfold theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check in avia-export-class.php in all versions up to, a… |
CVE-2025-1644 | Medium | 4.3 | 2025-02-25 | A vulnerability classified as problematic has been found in Benner ModernaNet up to 1.2.0. Affected is an unknown function of the file /DadosPessoais/SG_Gravar… |
CVE-2025-1643 | Medium | 4.3 | 2025-02-25 | A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been rated as problematic. This issue affects some unknown processing of the file /DadosPess… |