CWE-862 · Missing Authorization (page 53)
Page 53 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-47534 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in ValvePress Wordpress Auto Spinner wp-auto-spinner allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-39511 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in ValvePress Pinterest Automatic Pin wp-pinterest-automatic allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-39493 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in ValvePress Rankie valvepress-rankie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-39482 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in imithemes Eventer eventer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eve… |
CVE-2025-32296 | Medium | 5.3 | 2025-05-16 | Missing Authorization vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-32295 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in wordpresschef Salon Booking Pro salon-booking-plugin-pro-cc allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-31923 | Medium | 5.4 | 2025-05-16 | Missing Authorization vulnerability in QuanticaLabs CSS3 Accordions for WordPress css3_accordions allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-31630 | Medium | 5.3 | 2025-05-16 | Missing Authorization vulnerability in themeton The Business allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Bu… |
CVE-2025-31071 | Medium | 5.3 | 2025-05-16 | Missing Authorization vulnerability in themeton HotStar – Multi-Purpose Business Theme allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-31066 | Medium | 5.3 | 2025-05-16 | Missing Authorization vulnerability in themeton Acerola acerola allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acer… |
CVE-2025-31065 | Medium | 5.3 | 2025-05-16 | Missing Authorization vulnerability in themeton Rozario allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Rozario: fr… |
CVE-2025-31063 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in redqteam Wishlist wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wi… |
CVE-2025-47792 | Medium | 5.0 | 2025-05-16 | Nextcloud Desktop is the desktop sync client for Nextcloud. In versions of Nextcloud Desktop prior to 3.15, 3rdparty applications already installed on a user m… |
CVE-2025-3624 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view component).This issue affects Hitachi Ops Center An… |
CVE-2024-12812 | High | 7.5 | 2025-05-15 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected by an IDOR issue wh… |
CVE-2024-56006 | Medium | 5.3 | 2025-05-15 | Missing Authorization vulnerability in Automattic Jetpack Debug Tools.This issue affects Jetpack Debug Tools: from n/a before 2.0.1. |
CVE-2024-51666 | Medium | 4.3 | 2025-05-15 | Missing Authorization vulnerability in Tosin Oguntuyi Tours tours.This issue affects Tours: from n/a through <= 1.0.0. |
CVE-2025-47580 | Medium | 5.4 | 2025-05-15 | Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-47887 | Medium | 4.3 | 2025-05-14 | Missing permission checks in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers with Overall/Read permission to connect to… |
CVE-2024-58101 | High | 8.1 | 2025-05-14 | Samsung Galaxy Buds and Galaxy Buds 2 audio devices are Bluetooth pairable by default without user input nor a way to stop this mode. As a consequence, audio p… |
CVE-2025-47709 | Medium | 6.5 | 2025-05-14 | Missing Authorization vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Forceful Browsing.This issue affects Enterprise MFA - TFA for Drupal: from… |
CVE-2025-24021 | Medium | 5.0 | 2025-05-14 | iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can set value to objec… |
CVE-2025-4430 | | 2025-05-14 | Unauthorized access to "/api/Token/gettoken" endpoint in EZD RP allows file manipulation.This issue affects EZD RP in versions before 20.19 (published on 22nd… | |
CVE-2025-4520 | Medium | 5.4 | 2025-05-14 | The Uncanny Automator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in v… |
CVE-2025-4339 | Medium | 4.3 | 2025-05-13 | The TheGem theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxApi() function in all versions u… |
CVE-2025-43011 | High | 7.7 | 2025-05-13 | Under certain conditions, SAP Landscape Transformation's PCL Basis module does not perform the necessary authorization checks, allowing authenticated users to… |
CVE-2025-43009 | Medium | 6.3 | 2025-05-13 | SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This… |
CVE-2025-43008 | Medium | 5.8 | 2025-05-13 | Due to missing authorization check, an unauthorized user can view the files of other company. This might lead to disclosure of personal data of employees. Ther… |
CVE-2025-43007 | Medium | 6.3 | 2025-05-13 | SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This… |
CVE-2025-43004 | Medium | 5.3 | 2025-05-13 | Due to a security misconfiguration vulnerability, customers can develop Production Operator Dashboards (PODs) that enable outside users to access customer data… |
CVE-2025-43000 | High | 7.9 | 2025-05-13 | Under certain conditions Promotion Management Wizard (PMW) allows an attacker to access information which would otherwise be restricted.This has High impact on… |
CVE-2025-30448 | Critical | 9.1 | 2025-05-12 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.4, macOS Sonoma 1… |
CVE-2025-46745 | Medium | 6.5 | 2025-05-12 | An authenticated user without user-management permissions could view other users account information. |
CVE-2025-26846 | Critical | 9.8 | 2025-05-12 | An issue was discovered in Znuny before 7.1.4. Permissions are not checked properly when using the Generic Interface to update ticket metadata. |
CVE-2025-3876 | High | 8.8 | 2025-05-10 | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to insufficient user OTP validation in the handl… |
CVE-2025-28202 | High | 8.8 | 2025-05-09 | Incorrect access control in Victure RX1800 EN_V1.0.0_r12_110933 allows attackers to enable SSH and Telnet services without authentication. |
CVE-2025-3949 | Medium | 4.3 | 2025-05-09 | The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized ac… |
CVE-2025-20164 | High | 8.3 | 2025-05-07 | A vulnerability in the Cisco Industrial Ethernet Switch Device Manager (DM) of Cisco IOS Software could allow an authenticated, remote attacker to elevate priv… |
CVE-2025-47692 | Medium | 4.3 | 2025-05-07 | Missing Authorization vulnerability in contentstudio Contentstudio contentstudio allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-47688 | Medium | 5.3 | 2025-05-07 | Missing Authorization vulnerability in Saad Iqbal Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-47628 | Medium | 5.4 | 2025-05-07 | Missing Authorization vulnerability in quomodosoft QS Dark Mode qs-dark-mode allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-47612 | Medium | 5.4 | 2025-05-07 | Missing Authorization vulnerability in ClickWhale ClickWhale clickwhale allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-47602 | Medium | 5.4 | 2025-05-07 | Missing Authorization vulnerability in ammarahmad786 Calculate Prices based on Distance For WooCommerce calculate-prices-based-on-distance-for-woocommerce allo… |
CVE-2025-47591 | Medium | 4.3 | 2025-05-07 | Missing Authorization vulnerability in CreedAlly Bulk Featured Image bulk-featured-image allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-47528 | Medium | 4.3 | 2025-05-07 | Missing Authorization vulnerability in pewilliams Ovation Elements ovation-elements allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-47526 | Medium | 5.4 | 2025-05-07 | Missing Authorization vulnerability in GS Plugins GS Variation Swatches for WooCommerce gs-woo-variation-swatches allows Exploiting Incorrectly Configured Acce… |
CVE-2025-47486 | Medium | 5.3 | 2025-05-07 | Missing Authorization vulnerability in CyberChimps Responsive Plus responsive-add-ons allows Accessing Functionality Not Properly Constrained by ACLs.This issu… |
CVE-2025-47485 | Medium | 5.3 | 2025-05-07 | Missing Authorization vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-47480 | Medium | 5.4 | 2025-05-07 | Missing Authorization vulnerability in Iqonic Design Graphina graphina-elementor-charts-and-graphs allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-47472 | Medium | 5.4 | 2025-05-07 | Missing Authorization vulnerability in codepeople Music Player for WooCommerce music-player-for-woocommerce allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-47471 | Medium | 4.3 | 2025-05-07 | Missing Authorization vulnerability in EnvoThemes Envo Extra envo-extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-47469 | Medium | 5.4 | 2025-05-07 | Missing Authorization vulnerability in slui Media Hygiene media-hygiene allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-47467 | Medium | 4.3 | 2025-05-07 | Missing Authorization vulnerability in GS Plugins GS Testimonial Slider gs-testimonial allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-47465 | Medium | 4.9 | 2025-05-07 | Missing Authorization vulnerability in creativethemeshq Blocksy blocksy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-47457 | Medium | 5.3 | 2025-05-07 | Missing Authorization vulnerability in dgamoni LocateAndFilter locateandfilter allows Accessing Functionality Not Properly Constrained by ACLs.This issue affec… |
CVE-2025-47450 | Medium | 5.3 | 2025-05-07 | Missing Authorization vulnerability in Mitchell Bennis Simple File List simple-file-list allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-3766 | Medium | 5.4 | 2025-05-07 | The Login Lockdown & Protection plugin for WordPress is vulnerable to unauthorized nonce access due to a missing capability check on the ajax_run_tool function… |
CVE-2025-2821 | Medium | 5.3 | 2025-05-07 | The Search Exclude plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_rest_permission functio… |
CVE-2025-0856 | High | 7.3 | 2025-05-06 | The PGS Core plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions… |
CVE-2025-4327 | Medium | 4.3 | 2025-05-06 | A vulnerability was found in MRCMS 3.1.2. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request… |
CVE-2025-46586 | Medium | 5.1 | 2025-05-06 | Permission control vulnerability in the contacts module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-4282 | Medium | 4.3 | 2025-05-05 | A vulnerability has been found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as problematic. This vulnerability affects unknown code o… |
CVE-2025-3927 | Critical | 9.8 | 2025-05-02 | Digigram's PYKO-OUT audio-over-IP (AoIP) web-server does not require a password by default, allowing any attacker with the target IP address to connect and com… |
CVE-2025-1326 | Medium | 4.3 | 2025-05-02 | The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homey_reservation_del() function in a… |
CVE-2024-13420 | Medium | 4.3 | 2025-05-02 | Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_se… |
CVE-2024-13419 | Medium | 6.4 | 2025-05-02 | Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability check on the saveO… |
CVE-2025-4179 | High | 7.3 | 2025-05-02 | The Flynax Bridge plugin for WordPress is vulnerable to limited Privilege Escalation due to a missing capability check on the registerUser() function in all ve… |
CVE-2025-4177 | Medium | 5.3 | 2025-05-02 | The Flynax Bridge plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteUser() function in all version… |
CVE-2025-3746 | Critical | 9.8 | 2025-05-02 | The OTP-less one tap Sign in plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.14 to 2.0.59. This is due to the p… |
CVE-2025-3952 | High | 8.1 | 2025-05-01 | The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due… |
CVE-2025-1304 | High | 8.8 | 2025-05-01 | The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and_activate_plugin()… |
CVE-2025-2816 | High | 8.1 | 2025-05-01 | The Page View Count plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability ch… |
CVE-2025-46557 | Critical | 9.8 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 15.3-rc-1 to before 15.10.14, from 16.0.0-rc-1 to before 16.4.6, and from 16.5.0-rc-1 to before 16… |
CVE-2025-46554 | Medium | 5.3 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 1.8.1 to before 14.10.22, from 15.0-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and… |
CVE-2025-39413 | Medium | 4.3 | 2025-04-30 | Missing Authorization vulnerability in David Gwyer Simple Sitemap – Create a Responsive HTML Sitemap simple-sitemap.This issue affects Simple Sitemap – Create… |
CVE-2025-21416 | High | 8.5 | 2025-04-30 | Missing authorization in Azure Virtual Desktop allows an authorized attacker to elevate privileges over a network. |
CVE-2025-32973 | Critical | 9.0 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16… |
CVE-2025-3953 | Medium | 5.4 | 2025-04-30 | The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing… |
CVE-2025-46348 | Critical | 10.0 | 2025-04-29 | YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication… |
CVE-2025-4095 | | 2025-04-29 | Registry Access Management (RAM) is a security feature allowing administrators to restrict access for their developers to only allowed registries. When a MacOS… | |
CVE-2025-4064 | Medium | 5.3 | 2025-04-29 | A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/vie… |
CVE-2025-3452 | Medium | 4.3 | 2025-04-29 | The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'secup… |
CVE-2025-39367 | Medium | 5.3 | 2025-04-28 | Missing Authorization vulnerability in SeventhQueen Kleo kleo.This issue affects Kleo: from n/a through < 5.4.4. |
CVE-2025-3997 | Medium | 4.3 | 2025-04-28 | A vulnerability classified as problematic has been found in dazhouda lecms 3.0.3. This affects an unknown part of the file /index.php?my-profile-ajax-1 of the… |
CVE-2025-3981 | Medium | 4.3 | 2025-04-27 | A vulnerability, which was classified as problematic, has been found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0. This issue affects some u… |
CVE-2025-3980 | Medium | 4.3 | 2025-04-27 | A vulnerability classified as problematic was found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0. This vulnerability affects unknown code of… |
CVE-2025-3979 | Medium | 4.3 | 2025-04-27 | A vulnerability classified as problematic has been found in dazhouda lecms 3.0.3. This affects an unknown part of the file /index.php?my-password-ajax-1 of the… |
CVE-2025-3977 | Medium | 4.3 | 2025-04-27 | A vulnerability was found in iteachyou Dreamer CMS up to 4.1.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2025-3964 | Medium | 4.3 | 2025-04-27 | A vulnerability, which was classified as problematic, was found in withstars Books-Management-System 1.0. Affected is an unknown function of the file /api/arti… |
CVE-2025-3963 | High | 7.3 | 2025-04-27 | A vulnerability, which was classified as critical, has been found in withstars Books-Management-System 1.0. This issue affects some unknown processing of the f… |
CVE-2025-3960 | High | 7.3 | 2025-04-27 | A vulnerability was found in withstars Books-Management-System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the… |
CVE-2025-3959 | Medium | 4.3 | 2025-04-27 | A vulnerability was found in withstars Books-Management-System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functiona… |
CVE-2025-3915 | Medium | 4.3 | 2025-04-26 | The Aeropage Sync for Airtable plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'aeropageDeletePost' fu… |
CVE-2025-3906 | High | 8.8 | 2025-04-26 | The Integração entre Eduzz e Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wep_… |
CVE-2025-43862 | High | 7.6 | 2025-04-25 | Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web… |
CVE-2025-32045 | Medium | 5.3 | 2025-04-25 | A flaw has been identified in Moodle where insufficient capability checks in certain grade reports allowed users without the necessary permissions to access hi… |
CVE-2025-3912 | Medium | 5.3 | 2025-04-25 | The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability… |
CVE-2025-1279 | High | 8.8 | 2025-04-25 | The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capabilit… |
CVE-2025-46535 | Medium | 5.4 | 2025-04-25 | Missing Authorization vulnerability in AlphaEfficiencyTeam Custom Login and Registration allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-46519 | Medium | 4.3 | 2025-04-24 | Missing Authorization vulnerability in M.Code Media Library Downloader media-library-downloader allows Exploiting Incorrectly Configured Access Control Securit… |