CWE-862 · Missing Authorization (page 49)
Page 49 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-22318 | High | 7.5 | 2025-01-21 | Missing Authorization vulnerability in enituretechnology Standard Box Sizes – for WooCommerce standard-box-sizes.This issue affects Standard Box Sizes – for Wo… |
CVE-2024-12104 | Medium | 5.3 | 2025-01-21 | The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capab… |
CVE-2025-0515 | Medium | 4.3 | 2025-01-18 | The Buzz Club – Night Club, DJ and Music Festival Event WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to… |
CVE-2024-12071 | Medium | 5.3 | 2025-01-18 | The Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media plugin for WordPress is vulnerable to unauthorized loss of data due to… |
CVE-2018-9406 | Medium | 5.5 | 2025-01-18 | In NlpService, there is a possible way to obtain location information due to a missing permission check. This could lead to local escalation of privilege with… |
CVE-2018-9382 | High | 7.8 | 2025-01-17 | In multiple functions of WifiServiceImpl.java, there is a possible way to activate Wi-Fi hotspot from a non-owner profile due to a missing permission check. Th… |
CVE-2024-50967 | Medium | 6.5 | 2025-01-17 | The /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability. An attacker can remotely access this e… |
CVE-2024-12370 | Medium | 5.3 | 2025-01-17 | The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check when adding rooms in all version… |
CVE-2024-13367 | Medium | 6.5 | 2025-01-17 | The Sandbox plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the export_download action in all versions up to, an… |
CVE-2024-46450 | High | 8.1 | 2025-01-16 | Incorrect access control in Tenda AC1200 Smart Dual-Band WiFi Router Model AC6 v2.0 Firmware v15.03.06.50 allows attackers to bypass authentication via a craft… |
CVE-2025-23963 | Medium | 5.4 | 2025-01-16 | Missing Authorization vulnerability in flymke Mark Posts mark-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-23962 | Medium | 4.3 | 2025-01-16 | Missing Authorization vulnerability in jjtrabucco Goldstar goldstar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-23961 | Medium | 5.4 | 2025-01-16 | Missing Authorization vulnerability in wptasker WordPress Graphs & Charts graph-lite allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-23957 | Medium | 4.3 | 2025-01-16 | Missing Authorization vulnerability in surdotly Sur.ly surly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sur.ly… |
CVE-2025-23955 | Medium | 4.3 | 2025-01-16 | Missing Authorization vulnerability in xola Xola xola-bookings-for-tours-activities allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-23954 | Medium | 4.3 | 2025-01-16 | Missing Authorization vulnerability in awcode Salvador – AI Image Generator salvador-ai-image-generator allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-23930 | Medium | 4.3 | 2025-01-16 | Missing Authorization vulnerability in paypalmuse PayPal Marketing Solutions paypal-promotions-and-insights allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-23929 | Medium | 4.3 | 2025-01-16 | Missing Authorization vulnerability in wishfulthemes Email Capture & Lead Generation email-capture-lead-generation allows Exploiting Incorrectly Configured Acc… |
CVE-2025-23917 | Medium | 5.4 | 2025-01-16 | Missing Authorization vulnerability in Chandrika Guntur, Morgan Kay Chamber Dashboard Business Directory allows Exploiting Incorrectly Configured Access Contro… |
CVE-2025-23916 | Medium | 5.4 | 2025-01-16 | Missing Authorization vulnerability in Nuanced Media WP Meetup wp-meetup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-23862 | Medium | 5.3 | 2025-01-16 | Missing Authorization vulnerability in SzMake Contact Form 7 Anti Spambot contact-form-7-anti-spambot allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-23785 | Medium | 4.3 | 2025-01-16 | Missing Authorization vulnerability in August Infotech AI Responsive Gallery Album ai-responsive-gallery-album allows Exploiting Incorrectly Configured Access… |
CVE-2025-23778 | Medium | 5.4 | 2025-01-16 | Missing Authorization vulnerability in Pravin Durugkar User Sync ActiveCampaign registered-user-sync-activecampaign allows Exploiting Incorrectly Configured Ac… |
CVE-2025-23776 | Medium | 4.3 | 2025-01-16 | Missing Authorization vulnerability in ekaterir Cache Sniper for Nginx snipe-nginx-cache allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-23764 | Medium | 5.3 | 2025-01-16 | Missing Authorization vulnerability in ujjavaljani Copy Move Posts copy-move-posts.This issue affects Copy Move Posts: from n/a through <= 1.6. |
CVE-2025-23761 | Medium | 5.4 | 2025-01-16 | Missing Authorization vulnerability in Alex Volkov Woo Tuner allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Woo Tu… |
CVE-2025-23514 | Medium | 5.3 | 2025-01-16 | Missing Authorization vulnerability in Sanjay Prasad Loginplus loginplus allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Log… |
CVE-2025-23423 | Medium | 4.3 | 2025-01-16 | Missing Authorization vulnerability in Smackcoders Inc., SendGrid for WordPress wp-sendgrid-mailer allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2024-57682 | Medium | 6.5 | 2025-01-16 | An information disclosure vulnerability in the component d_status.asp of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to access sens… |
CVE-2024-12614 | High | 7.5 | 2025-01-16 | The Passwords Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pms_save_setting' and '… |
CVE-2024-12427 | Medium | 5.3 | 2025-01-16 | The Multi Step Form plugin for WordPress is vulnerable to unauthorized limited file upload due to a missing capability check on the fw_upload_file AJAX action… |
CVE-2024-57726 | Critical | 9.9 | 2025-01-15 | SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions… |
CVE-2024-54470 | Medium | 4.6 | 2025-01-15 | A logic issue was addressed with improved checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1. An attacker with physical acce… |
CVE-2024-40839 | Low | 2.4 | 2025-01-15 | This issue was addressed through improved state management. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access to an iOS device… |
CVE-2025-22787 | Medium | 4.3 | 2025-01-15 | Missing Authorization vulnerability in bPlugins Button Block button-block allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bu… |
CVE-2025-22779 | Medium | 4.3 | 2025-01-15 | Missing Authorization vulnerability in codeaffairs WP News Sliders wp-news-sliders allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-22737 | Medium | 5.3 | 2025-01-15 | Missing Authorization vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issu… |
CVE-2025-22729 | Medium | 4.3 | 2025-01-15 | Missing Authorization vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2024-56295 | Medium | 6.5 | 2025-01-15 | Missing Authorization vulnerability in Ays Pro Poll Maker poll-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2024-11851 | Medium | 4.3 | 2025-01-15 | The NitroPack plugin for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the nitropack_rml_notification… |
CVE-2024-11848 | High | 8.1 | 2025-01-15 | The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nitropack_dismiss_notice_foreve… |
CVE-2024-57757 | High | 7.5 | 2025-01-15 | JeeWMS before v2025.01.01 was discovered to contain a permission bypass in the component /interceptors/AuthInterceptor.cava. |
CVE-2025-23025 | Critical | 9.0 | 2025-01-14 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. NOTE: The Realtime WYSIWYG Editor extension was **expe… |
CVE-2024-12365 | High | 8.5 | 2025-01-14 | The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_page function in al… |
CVE-2024-12006 | Medium | 5.3 | 2025-01-14 | The W3 Total Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versio… |
CVE-2025-0068 | Medium | 4.3 | 2025-01-14 | An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary authorization checks. Because of this, an authenticated attacker c… |
CVE-2025-0067 | Medium | 6.3 | 2025-01-14 | Due to a missing authorization check on service endpoints in the SAP NetWeaver Application Server Java, an attacker with standard user role can create JCo conn… |
CVE-2025-22800 | Medium | 4.3 | 2025-01-13 | Missing Authorization vulnerability in Saad Iqbal Post SMTP post-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2024-12204 | Medium | 5.4 | 2025-01-11 | The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to unauthorized access due to mis… |
CVE-2024-12606 | Medium | 4.3 | 2025-01-10 | The AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) plugin for WordPres… |
CVE-2024-13312 | Medium | 5.3 | 2025-01-09 | Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 11.8.0 before 12.3.10, from 12.4.0 befo… |
CVE-2024-13303 | Medium | 5.3 | 2025-01-09 | Missing Authorization vulnerability in Drupal Download All Files allows Forceful Browsing.This issue affects Download All Files: from 0.0.0 before 2.0.2. |
CVE-2024-13243 | Medium | 6.5 | 2025-01-09 | Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1. |
CVE-2025-22561 | Medium | 4.3 | 2025-01-09 | Missing Authorization vulnerability in kbowson Title Experiments Free wp-experiments-free allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2024-6155 | Medium | 6.4 | 2025-01-09 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cro… |
CVE-2024-5769 | Medium | 4.3 | 2025-01-09 | The MIMO Woocommerce Order Tracking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functi… |
CVE-2024-12848 | High | 8.8 | 2025-01-09 | The SKT Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the 'addLibraryByArchive' function in al… |
CVE-2024-12618 | Medium | 4.3 | 2025-01-09 | The Newsletter2Go plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resetStyles' AJAX action in… |
CVE-2024-12616 | Medium | 4.3 | 2025-01-09 | The Bitly's WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX act… |
CVE-2024-12542 | High | 8.6 | 2025-01-09 | The linkID plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all ver… |
CVE-2024-12249 | Medium | 4.3 | 2025-01-09 | The GS Insever Portfolio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings() funct… |
CVE-2024-11929 | Medium | 6.4 | 2025-01-09 | The Responsive FlipBook Plugin Wordpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the rfbwp_save_settings() functionin all version… |
CVE-2024-43662 | | 2025-01-09 | The <redacted>.exe or <redacted>.exe CGI binary can be used to upload arbitrary files to /tmp/upload/ or /tmp/ respectively as any user, although the user inte… | |
CVE-2024-13203 | Medium | 4.3 | 2025-01-09 | A vulnerability was found in kurniaramadhan E-Commerce-PHP 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads… |
CVE-2024-12431 | Medium | 4.3 | 2025-01-08 | An issue was discovered in GitLab CE/EE affecting all versions starting from 15.5 before 17.5.5, 17.6 before 17.6.3, and 17.7 before 17.7.1, in which unauthori… |
CVE-2024-11423 | High | 7.5 | 2025-01-08 | The Ultimate Gift Cards for WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule… |
CVE-2024-12712 | Medium | 5.3 | 2025-01-08 | The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the webhook fu… |
CVE-2024-12855 | Medium | 4.3 | 2025-01-08 | The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions like 'sb_remove_a… |
CVE-2024-11271 | High | 8.8 | 2025-01-08 | The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to modification of data due to a missing capability check on several functions i… |
CVE-2024-11270 | High | 8.8 | 2025-01-08 | The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the 'sync-import… |
CVE-2024-12713 | Medium | 5.3 | 2025-01-08 | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2… |
CVE-2024-11916 | High | 7.4 | 2025-01-08 | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capabil… |
CVE-2024-11816 | High | 8.8 | 2025-01-08 | The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Remote Code Execution in version 3.0.11. This is due to a missing capability… |
CVE-2025-22363 | Medium | 5.3 | 2025-01-07 | Missing Authorization vulnerability in Hermann LAHAMI Allada T-shirt Designer for Woocommerce allada-tshirt-designer-for-woocommerce.This issue affects Allada… |
CVE-2025-22319 | Medium | 4.3 | 2025-01-07 | Missing Authorization vulnerability in DearHive Social Media Share Buttons | MashShare.This issue affects Social Media Share Buttons | MashShare: from n/a thro… |
CVE-2024-56272 | Medium | 4.3 | 2025-01-07 | Missing Authorization vulnerability in ThemeSupport Hide Category by User Role for WooCommerce hide-category-by-user-role-for-woocommerce.This issue affects Hi… |
CVE-2024-56270 | Medium | 5.3 | 2025-01-07 | Missing Authorization vulnerability in SecureSubmit WP SecureSubmit securesubmit allows Retrieve Embedded Sensitive Data.This issue affects WP SecureSubmit: fr… |
CVE-2025-22592 | High | 7.5 | 2025-01-07 | Missing Authorization vulnerability in 8blocks 1003 Mortgage Application 1003-mortgage-application allows Accessing Functionality Not Properly Constrained by A… |
CVE-2025-22591 | Medium | 4.3 | 2025-01-07 | Missing Authorization vulnerability in 8blocks 1003 Mortgage Application 1003-mortgage-application allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-22560 | Medium | 5.3 | 2025-01-07 | Missing Authorization vulnerability in saoshyant1994 Saoshyant Page Builder saoshyant-page-builder allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-22543 | Medium | 5.4 | 2025-01-07 | Missing Authorization vulnerability in beautifultemplates ST Gallery WP st-gallery-wp allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-22541 | Medium | 5.4 | 2025-01-07 | Missing Authorization vulnerability in etruel WP Delete Post Copies etruel-del-post-copies allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-22534 | Medium | 5.4 | 2025-01-07 | Missing Authorization vulnerability in Ella Van Durpe Slides & Presentations slide allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-22512 | Medium | 4.3 | 2025-01-07 | Missing Authorization vulnerability in BoldGrid Help Scout help-scout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2024-12711 | Medium | 5.3 | 2025-01-07 | The RSVP and Event Management plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX functions like bulk_d… |
CVE-2024-12316 | Medium | 5.3 | 2025-01-07 | The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_popup_action() function in… |
CVE-2024-12033 | Medium | 4.3 | 2025-01-07 | The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the sync_libraries() function in all versions… |
CVE-2025-22304 | Medium | 4.3 | 2025-01-07 | Missing Authorization vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-stats-manager allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-22302 | Medium | 5.3 | 2025-01-07 | Missing Authorization vulnerability in WP Grids WP Wand ai-content-generation allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-22299 | Medium | 4.3 | 2025-01-07 | Missing Authorization vulnerability in Space Codes AI for SEO ai-for-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-22298 | Medium | 4.3 | 2025-01-07 | Missing Authorization vulnerability in Hive Support Hive Support hive-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2024-56294 | Medium | 6.4 | 2025-01-07 | Missing Authorization vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2024-56276 | Medium | 4.3 | 2025-01-07 | Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2024-56273 | Medium | 4.3 | 2025-01-07 | Missing Authorization vulnerability in wpvividplugins WPvivid Backup and Migration wpvivid-backuprestore allows Accessing Functionality Not Properly Constraine… |
CVE-2024-56271 | Medium | 4.3 | 2025-01-07 | Missing Authorization vulnerability in SecureSubmit WP SecureSubmit securesubmit allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2024-51651 | Medium | 5.3 | 2025-01-07 | Missing Authorization vulnerability in Imran Tauqeer CubeWP Forms cubewp-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2024-12719 | Medium | 4.3 | 2025-01-07 | The WordPress File Upload plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wfu_ajax_action_read_subf… |
CVE-2024-12202 | High | 8.8 | 2025-01-07 | The Croma Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check… |
CVE-2024-10866 | Medium | 5.3 | 2025-01-07 | The Export Import Menus plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dsp_export_import_menus() fu… |
CVE-2024-12781 | Medium | 4.3 | 2025-01-07 | The Aurum - WordPress & WooCommerce Shopping Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on… |