CWE-862 · Missing Authorization (page 47)
Page 47 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-27356 | Medium | 5.4 | 2025-02-24 | Missing Authorization vulnerability in Hardik Sticky Header On Scroll sticky-header-on-scroll allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-27296 | High | 7.2 | 2025-02-24 | Missing Authorization vulnerability in revenueflex Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue revenueflex-easy-ads allows Exploiting Inc… |
CVE-2025-27294 | Medium | 4.8 | 2025-02-24 | Missing Authorization vulnerability in platcom WP-Asambleas wp-asambleas allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-26883 | Medium | 6.5 | 2025-02-24 | Missing Authorization vulnerability in bPlugins Animated Text Block animated-text-block allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-26764 | Medium | 6.5 | 2025-02-22 | Missing Authorization vulnerability in enituretechnology Distance Based Shipping Calculator distance-based-shipping-calculator allows Exploiting Incorrectly Co… |
CVE-2025-26750 | Medium | 6.5 | 2025-02-22 | Missing Authorization vulnerability in appsbd Vitepos vitepos-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects V… |
CVE-2025-1557 | Medium | 4.3 | 2025-02-22 | A vulnerability, which was classified as problematic, was found in OFCMS 1.1.3. Affected is an unknown function. The manipulation leads to cross-site request f… |
CVE-2025-1361 | High | 7.5 | 2025-02-22 | The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure in all versions up to, and including, 2.38.8 due to missing… |
CVE-2025-1402 | Medium | 5.3 | 2025-02-21 | The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ajax_ticket_delete… |
CVE-2025-1483 | Medium | 5.3 | 2025-02-20 | The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the e… |
CVE-2024-13520 | Medium | 5.3 | 2025-02-20 | The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to… |
CVE-2024-37363 | Medium | 6.5 | 2025-02-20 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. (CWE-862) Hitachi Vantara Pentaho… |
CVE-2025-0968 | Medium | 5.3 | 2025-02-19 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.0 due to a mis… |
CVE-2024-13364 | Medium | 5.3 | 2025-02-19 | The Raptive Ads plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the site_ads_files_reset() and cls_file_reset()… |
CVE-2024-13231 | Medium | 5.3 | 2025-02-19 | The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2024-13719 | Medium | 5.3 | 2025-02-19 | The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.9 via the invoic… |
CVE-2024-13468 | High | 7.5 | 2025-02-19 | The Trash Duplicate and 301 Redirect plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'duplicates-actio… |
CVE-2025-27013 | Medium | 5.3 | 2025-02-18 | Missing Authorization vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-22657 | High | 7.5 | 2025-02-18 | Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2024-13783 | Medium | 4.3 | 2025-02-18 | The FormCraft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in formcraft-main.php in all versions up to… |
CVE-2024-13316 | Medium | 5.3 | 2025-02-18 | The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to unautho… |
CVE-2024-13556 | High | 8.1 | 2025-02-18 | The Affiliate Links: WordPress Plugin for Link Cloaking and Link Management plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, a… |
CVE-2024-13687 | Medium | 4.3 | 2025-02-18 | The Team Builder – Meet the Team plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_team_bui… |
CVE-2024-13677 | High | 8.8 | 2025-02-18 | The GetBookingsWP – Appointments Booking Calendar Plugin For WordPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all v… |
CVE-2025-26773 | Medium | 4.3 | 2025-02-17 | Missing Authorization vulnerability in Adnan Analytify wp-analytify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-26765 | Medium | 5.4 | 2025-02-16 | Missing Authorization vulnerability in enituretechnology Distance Based Shipping Calculator distance-based-shipping-calculator allows Exploiting Incorrectly Co… |
CVE-2025-22291 | Medium | 5.3 | 2025-02-16 | Missing Authorization vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express Edition ltl-freight-quotes-worldwide-express-edition allows Exp… |
CVE-2025-22289 | Medium | 6.5 | 2025-02-16 | Missing Authorization vulnerability in enituretechnology LTL Freight Quotes – Unishippers Edition ltl-freight-quotes-unishippers-edition allows Exploiting Inco… |
CVE-2025-1358 | Medium | 4.3 | 2025-02-16 | A vulnerability classified as problematic was found in Pix Software Vivaz 6.0.10. This vulnerability affects unknown code. The manipulation leads to cross-site… |
CVE-2024-13439 | Medium | 4.3 | 2025-02-15 | The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the response() function… |
CVE-2024-13752 | Medium | 6.5 | 2025-02-15 | The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to unauthorized l… |
CVE-2025-0935 | Medium | 4.3 | 2025-02-15 | The Media Library Folders plugin for WordPress is vulnerable to unauthorized plugin settings change due to a missing capability check on several AJAX actions i… |
CVE-2024-13513 | Critical | 9.8 | 2025-02-15 | The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2… |
CVE-2025-24692 | High | 7.1 | 2025-02-14 | Missing Authorization vulnerability in M.Code Bulk Menu Edit bulk-menu-edit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-24607 | Medium | 5.8 | 2025-02-14 | Missing Authorization vulnerability in Northern Beaches Websites IdeaPush ideapush allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-23771 | Medium | 6.5 | 2025-02-14 | Missing Authorization vulnerability in Murali Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly… |
CVE-2025-23766 | Medium | 6.5 | 2025-02-14 | Missing Authorization vulnerability in ashamil OPSI Israel Domestic Shipments woo-ups-pickup allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-23534 | Medium | 6.5 | 2025-02-14 | Missing Authorization vulnerability in Mark Winiarski WPLingo wplingo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-22702 | Medium | 6.3 | 2025-02-14 | Missing Authorization vulnerability in ThemeGoods Photography photography allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-22698 | Medium | 6.3 | 2025-02-14 | Missing Authorization vulnerability in Ability, Inc Accessibility Suite online-accessibility allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2024-52500 | High | 7.2 | 2025-02-14 | Missing Authorization vulnerability in monetagwp Monetag Official Plugin monetag-official allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2024-13639 | Medium | 4.3 | 2025-02-13 | The Read More & Accordion plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the expmDeleteD… |
CVE-2024-13229 | Medium | 4.3 | 2025-02-13 | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on… |
CVE-2025-1214 | Medium | 6.3 | 2025-02-12 | A vulnerability classified as critical has been found in pihome-shc PiHome 2.0. This affects an unknown part of the file /user_accounts.php?uid of the componen… |
CVE-2025-26378 | High | 8.8 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged… |
CVE-2025-26377 | High | 8.1 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged… |
CVE-2025-26376 | Medium | 6.5 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged… |
CVE-2025-26375 | High | 8.8 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged… |
CVE-2025-26374 | Medium | 6.5 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (users endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticate… |
CVE-2025-26373 | Medium | 6.5 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (user endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated… |
CVE-2025-26372 | High | 7.1 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priv… |
CVE-2025-26371 | High | 8.8 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priv… |
CVE-2025-26370 | High | 7.1 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priv… |
CVE-2025-26369 | High | 8.8 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priv… |
CVE-2025-26368 | High | 8.1 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priv… |
CVE-2025-26367 | Medium | 4.3 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priv… |
CVE-2024-12296 | High | 8.8 | 2025-02-12 | The Apus Framework plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability ch… |
CVE-2024-13374 | Medium | 4.3 | 2025-02-12 | The WP Table Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on thewptm_getFolders AJAX action in all versi… |
CVE-2024-13800 | High | 8.1 | 2025-02-12 | The ConvertPlus plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check… |
CVE-2024-13769 | Medium | 6.4 | 2025-02-12 | The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capabilit… |
CVE-2024-13656 | High | 8.1 | 2025-02-12 | The Click Mag - Viral WordPress News Magazine/Blog Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of se… |
CVE-2024-13654 | High | 8.1 | 2025-02-12 | The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service… |
CVE-2024-13653 | High | 8.8 | 2025-02-12 | The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation… |
CVE-2024-12164 | Medium | 4.3 | 2025-02-12 | The WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon plugin for WordPress is vulnerable to unauthorized modification of data due to a missing c… |
CVE-2024-13554 | Medium | 5.3 | 2025-02-12 | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t… |
CVE-2024-13541 | Medium | 4.3 | 2025-02-12 | The aDirectory – WordPress Directory Listing Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the ad… |
CVE-2025-0526 | Medium | 5.4 | 2025-02-11 | In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. The field lacked validation w… |
CVE-2024-13643 | High | 8.8 | 2025-02-11 | The Zox News - Professional WordPress News & Magazine Theme plugin for WordPress is vulnerable to unauthorized data modification. This vulnerability can lead t… |
CVE-2025-25241 | Medium | 5.4 | 2025-02-11 | Due to a missing authorization check, an attacker who is logged in to application can view/ delete �My Overtime Requests� which could allow the attacker to acc… |
CVE-2025-23190 | Medium | 4.3 | 2025-02-11 | Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would othe… |
CVE-2025-23189 | Medium | 4.3 | 2025-02-11 | Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an authenticated attacker could generate technical meta-data. This l… |
CVE-2025-23187 | Medium | 5.3 | 2025-02-11 | Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an unauthenticated attacker could generate technical meta-data. This… |
CVE-2025-25167 | High | 8.2 | 2025-02-07 | Missing Authorization vulnerability in Black and White BookPress – For Book Authors book-press allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-25120 | Medium | 4.3 | 2025-02-07 | Missing Authorization vulnerability in Melodic Media Slide Banners slide-banners allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-25110 | Medium | 5.4 | 2025-02-07 | Missing Authorization vulnerability in Metagauss Event Kikfyre kikfyre-events-calendar-tickets allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-25081 | Medium | 4.2 | 2025-02-07 | Missing Authorization vulnerability in DeannaS Embed RSS embed-rss allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects E… |
CVE-2025-1084 | Medium | 4.3 | 2025-02-07 | A vulnerability, which was classified as problematic, has been found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected by this issue is some unknown functionalit… |
CVE-2025-1074 | Medium | 4.3 | 2025-02-06 | A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Affected is the function logout of the file /en/?mylogout of the compo… |
CVE-2025-20125 | Critical | 9.1 | 2025-02-05 | A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker with valid read-only credentials to obtain sensitive information, change n… |
CVE-2024-3976 | Medium | 6.5 | 2025-02-05 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from… |
CVE-2024-1539 | Medium | 4.3 | 2025-02-05 | An issue has been discovered in GitLab EE affecting all versions starting from 15.2 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16… |
CVE-2025-22730 | Medium | 6.5 | 2025-02-04 | Missing Authorization vulnerability in ksher thailand Ksher ksher-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-22696 | Medium | 5.4 | 2025-02-04 | Missing Authorization vulnerability in WPDeveloper Document Block – Upload & Embed Docs document.This issue affects Document Block – Upload & Embed Docs: from… |
CVE-2025-22643 | Medium | 4.3 | 2025-02-04 | Missing Authorization vulnerability in famethemes OnePress onepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2024-13529 | Medium | 6.5 | 2025-02-04 | The SocialV - Social Network and Community BuddyPress Theme theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check… |
CVE-2023-52163 | High | 8.8 | 2025-02-03 | Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported… |
CVE-2024-11134 | Medium | 4.3 | 2025-02-03 | The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'eventer_export_bookings_csv' function i… |
CVE-2024-11133 | Medium | 5.3 | 2025-02-03 | The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_pdf_download_request' function i… |
CVE-2025-24697 | Medium | 6.5 | 2025-02-03 | Missing Authorization vulnerability in Realwebcare Image Gallery – Responsive Photo Gallery awesome-responsive-photo-gallery allows Exploiting Incorrectly Conf… |
CVE-2025-24643 | Medium | 6.5 | 2025-02-03 | Missing Authorization vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-24642 | Medium | 6.5 | 2025-02-03 | Missing Authorization vulnerability in theme funda Setup Default Featured Image setup-default-feature-image allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-23527 | Medium | 6.5 | 2025-02-03 | Missing Authorization vulnerability in hemnathmouli WC Wallet wc-wallet allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WC W… |
CVE-2025-22694 | Medium | 4.3 | 2025-02-03 | Missing Authorization vulnerability in Dotstore Hide Shipping Method For WooCommerce hide-shipping-method-for-woocommerce.This issue affects Hide Shipping Meth… |
CVE-2025-22686 | Medium | 5.3 | 2025-02-03 | Missing Authorization vulnerability in WesternDeal CF7 Google Sheets Connector cf7-google-sheets-connector allows Exploiting Incorrectly Configured Access Cont… |
CVE-2025-22681 | Medium | 4.3 | 2025-02-03 | Missing Authorization vulnerability in Xfinitysoft Content Cloner super-seo-content-cloner allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-22677 | Medium | 4.8 | 2025-02-03 | Missing Authorization vulnerability in UIUX Lab Uix Shortcodes uix-shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-22260 | Medium | 4.3 | 2025-02-03 | Missing Authorization vulnerability in Marcus (aka @msykes) Meta Tag Manager meta-tag-manager.This issue affects Meta Tag Manager: from n/a through <= 3.1. |
CVE-2024-50500 | Medium | 4.3 | 2025-02-03 | Missing Authorization vulnerability in averta Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Cont… |
CVE-2024-13775 | Medium | 5.4 | 2025-02-01 | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to unauthorized access and loss of data due to missing capability checks on the 'ajax_… |
CVE-2024-13371 | Medium | 5.3 | 2025-02-01 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized arbitrary emails sending… |