CWE-862 · Missing Authorization (page 57)
Page 57 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-30581 | Medium | 5.3 | 2025-03-24 | Missing Authorization vulnerability in PluginOps Top Bar ultimate-bar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-30543 | Medium | 4.3 | 2025-03-24 | Missing Authorization vulnerability in swayam.tejwani Menu Duplicator copy-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-1408 | Medium | 4.3 | 2025-03-22 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2024-13737 | Medium | 4.3 | 2025-03-22 | The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checks on th… |
CVE-2025-2589 | Medium | 5.5 | 2025-03-21 | A vulnerability was found in code-projects Human Resource Management System 1.0.1 and classified as critical. This issue affects the function Index of the file… |
CVE-2025-26853 | Critical | 10.0 | 2025-03-20 | DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 has a broken authorization schema. |
CVE-2024-9096 | High | 7.1 | 2025-03-20 | In lunary-ai/lunary version 1.4.28, the /checklists/:id route allows low-privilege users to modify checklists by sending a PATCH request. The route lacks prope… |
CVE-2024-9095 | Critical | 9.8 | 2025-03-20 | In lunary-ai/lunary version v1.4.28, the /bigquery API route lacks proper access control, allowing any logged-in user to create a Datastream to Google BigQuery… |
CVE-2024-9000 | Medium | 6.5 | 2025-03-20 | In lunary-ai/lunary before version 1.4.26, the checklists.post() endpoint allows users to create or modify checklists without validating whether the user has p… |
CVE-2024-8999 | High | 7.5 | 2025-03-20 | lunary-ai/lunary version v1.4.25 contains an improper access control vulnerability in the POST /api/v1/data-warehouse/bigquery endpoint. This vulnerability all… |
CVE-2024-7767 | High | 8.1 | 2025-03-20 | An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94. This vulnerability allows the first user created in the system to view… |
CVE-2024-7043 | High | 8.8 | 2025-03-20 | An improper access control vulnerability in open-webui/open-webui v0.3.8 allows attackers to view and delete any files. The application does not verify whether… |
CVE-2024-2292 | High | 7.1 | 2025-03-20 | Due to a lack of access control, unauthorized users are able to view and modify information pertaining to other users. |
CVE-2024-13060 | Medium | 4.3 | 2025-03-20 | A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' paramet… |
CVE-2024-10762 | High | 8.1 | 2025-03-20 | In lunary-ai/lunary before version 1.5.9, the /v1/evaluators/ endpoint allows users to delete evaluators of a project by sending a DELETE request. However, the… |
CVE-2024-10363 | Medium | 5.4 | 2025-03-20 | In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Users can share, use, and create prompts without being granted pe… |
CVE-2024-10330 | Medium | 6.5 | 2025-03-20 | In lunary-ai/lunary version 1.5.6, the `/v1/evaluators/` endpoint lacks proper access control, allowing any user associated with a project to fetch all evaluat… |
CVE-2024-10274 | Medium | 6.5 | 2025-03-20 | An improper authorization vulnerability exists in lunary-ai/lunary version 1.5.5. The /users/me/org endpoint lacks adequate access control mechanisms, allowing… |
CVE-2024-10272 | High | 7.5 | 2025-03-20 | lunary-ai/lunary is vulnerable to broken access control in the latest version. An attacker can view the content of any dataset without any kind of authorizatio… |
CVE-2025-1766 | Medium | 5.3 | 2025-03-20 | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing c… |
CVE-2025-29926 | Critical | 9.8 | 2025-03-19 | XWiki Platform is a generic wiki platform. Prior to 15.10.15, 16.4.6, and 16.10.0, any user can exploit the WikiManager REST API to create a new wiki, where th… |
CVE-2024-12920 | High | 8.8 | 2025-03-19 | The FoodBakery | Delivery Restaurant Directory WordPress Theme theme for WordPress is vulnerable to unauthorized access of data and modification of data due to… |
CVE-2024-13412 | High | 7.5 | 2025-03-19 | The CozyStay theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handler function in all versi… |
CVE-2024-12922 | Critical | 9.8 | 2025-03-19 | The Altair theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check withi… |
CVE-2025-2290 | Medium | 5.3 | 2025-03-19 | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability… |
CVE-2025-30107 | High | 7.5 | 2025-03-18 | On IROAD V9 devices, Managing Settings and Obtaining Sensitive Data and Sabotaging the Car Battery can be performed by unauthorized parties. A vulnerability in… |
CVE-2025-2262 | High | 7.3 | 2025-03-18 | The The Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation plugin for WordPress is vulnerable to arbitrary shortcode executi… |
CVE-2025-2420 | Medium | 4.3 | 2025-03-17 | A vulnerability classified as problematic was found in 猫宁i Morning up to bc782730c74ff080494f145cc363a0b4f43f7d3e. Affected by this vulnerability is an unknown… |
CVE-2025-26969 | High | 8.3 | 2025-03-15 | Missing Authorization vulnerability in Aldo Latino PrivateContent. This issue affects PrivateContent: from n/a through 8.11.5. |
CVE-2025-26961 | High | 8.6 | 2025-03-15 | Missing Authorization vulnerability in FRESHFACE Fresh Framework fresh-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue aff… |
CVE-2025-2025 | Medium | 6.5 | 2025-03-15 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on th… |
CVE-2025-2267 | Medium | 6.5 | 2025-03-15 | The WP01 plugin for WordPress is vulnerable to Arbitrary File Download in all versions up to, and including, 2.6.2 due to a missing capability check and insuff… |
CVE-2025-1668 | Medium | 4.3 | 2025-03-15 | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to arbitrary user deletion due to a missing capability check on the wpsp_Delete… |
CVE-2025-1667 | High | 8.8 | 2025-03-15 | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wpsp_UpdateTea… |
CVE-2024-12336 | Medium | 6.5 | 2025-03-15 | The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check… |
CVE-2025-1657 | High | 8.8 | 2025-03-15 | The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to unauthorized modification of data and PHP Object Injection due to a mi… |
CVE-2024-12810 | High | 8.8 | 2025-03-14 | The JobCareer | Job Board Responsive WordPress Theme theme for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing… |
CVE-2025-1507 | Medium | 5.3 | 2025-03-14 | The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the h… |
CVE-2025-2289 | Medium | 4.3 | 2025-03-14 | The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX endpoints in all… |
CVE-2025-2103 | High | 8.8 | 2025-03-14 | The SoundRise Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability c… |
CVE-2025-0952 | High | 8.1 | 2025-03-14 | The Eco Nature - Environment & Ecology WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of serv… |
CVE-2025-1528 | Medium | 4.3 | 2025-03-14 | The Search & Filter Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_meta_values' function i… |
CVE-2025-1285 | Medium | 5.3 | 2025-03-14 | The Resido - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the delete_api_key and s… |
CVE-2025-0955 | Medium | 5.3 | 2025-03-14 | The VidoRev Extensions plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'vidorev_import_single_video' AJAX ac… |
CVE-2025-27103 | Medium | 6.5 | 2025-03-13 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass for the patch for CVE-2024-55953 allows authent… |
CVE-2025-24974 | Medium | 6.5 | 2025-03-13 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, authenticated users can read and deserialize arbitrary f… |
CVE-2025-2104 | Medium | 4.3 | 2025-03-13 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to unauthorized post publication due to insufficient validation… |
CVE-2024-13703 | Medium | 4.3 | 2025-03-13 | The CRM and Lead Management by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_aja… |
CVE-2025-1508 | Medium | 5.3 | 2025-03-12 | The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_data action in all vers… |
CVE-2025-28938 | Medium | 4.3 | 2025-03-11 | Missing Authorization vulnerability in Bjoern WP Performance Pack wp-performance-pack allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-28920 | Medium | 5.3 | 2025-03-11 | Missing Authorization vulnerability in Jogesh Responsive Google Map responsive-google-map allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-28872 | Medium | 5.3 | 2025-03-11 | Missing Authorization vulnerability in jwpegram Block Spam By Math Reloaded block-spam-by-math-reloaded allows Accessing Functionality Not Properly Constrained… |
CVE-2025-27432 | Low | 2.4 | 2025-03-11 | The eDocument Cockpit (Inbound NF-e) in SAP Electronic Invoicing for Brazil allows an authenticated attacker with certain privileges to gain unauthorized acces… |
CVE-2025-26661 | High | 8.8 | 2025-03-11 | Due to missing authorization check, SAP NetWeaver (ABAP Class Builder) allows an attacker to gain higher access levels than they should have, resulting in esca… |
CVE-2025-26656 | Medium | 4.3 | 2025-03-11 | OData Service in Manage Purchasing Info Records does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate pri… |
CVE-2025-26655 | Low | 3.1 | 2025-03-11 | SAP Just In Time(JIT) does not perform necessary authorization checks for an authenticated user, allowing attacker to escalate privileges that would otherwise… |
CVE-2025-25244 | Medium | 5.7 | 2025-03-11 | SAP Business Warehouse (Process Chains) allows an attacker to manipulate the process execution due to missing authorization check. An attacker with display aut… |
CVE-2025-23188 | Medium | 4.3 | 2025-03-11 | An authenticated user with low privileges can exploit a missing authorization check in an IBS module of FS-RBD, allowing unauthorized access to perform actions… |
CVE-2024-10326 | Medium | 4.3 | 2025-03-08 | The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_options an… |
CVE-2025-1325 | Medium | 6.3 | 2025-03-08 | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to arbitrary shortcode execution due to a missing capability check on… |
CVE-2024-13816 | Medium | 5.4 | 2025-03-08 | The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to unauthorized access, mod… |
CVE-2025-1504 | Medium | 4.3 | 2025-03-08 | The Post Lockdown plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.0.2 via the 'pl_autocomplete' AJAX action… |
CVE-2025-1481 | Medium | 6.5 | 2025-03-08 | The Shortcode Cleaner Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_backup() functio… |
CVE-2024-12876 | Critical | 9.8 | 2025-03-07 | The Golo - City Travel Guide WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and includin… |
CVE-2024-12611 | Medium | 5.3 | 2025-03-07 | The School Management System for Wordpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to… |
CVE-2024-12610 | Medium | 5.3 | 2025-03-07 | The School Management System for Wordpress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'mj_smgt_re… |
CVE-2025-1309 | High | 8.8 | 2025-03-07 | The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data that can lead t… |
CVE-2024-13655 | High | 8.1 | 2025-03-07 | The Flex Mag - Responsive WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due… |
CVE-2024-13526 | Medium | 4.3 | 2025-03-07 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on… |
CVE-2025-2042 | Medium | 4.3 | 2025-03-06 | A vulnerability has been found in huang-yk student-manage 1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to… |
CVE-2025-1666 | Medium | 4.3 | 2025-03-06 | The Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing… |
CVE-2024-13423 | Medium | 5.3 | 2025-03-05 | The Sparkling theme for WordPress is vulnerable to unauthorized plugin activation/deactivation due to a missing capability check on the 'sparkling_activate_plu… |
CVE-2025-0954 | Medium | 6.5 | 2025-03-05 | The WP Online Contract plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the json_import() and json_export() funct… |
CVE-2024-13811 | Medium | 4.3 | 2025-03-05 | The Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability c… |
CVE-2024-13810 | Medium | 4.3 | 2025-03-05 | The Zass - WooCommerce Theme for Handmade Artists and Artisans theme for WordPress is vulnerable to unauthorized access due to a missing capability check on th… |
CVE-2024-13780 | Medium | 6.5 | 2025-03-05 | The Hero Mega Menu - Responsive WordPress Menu Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in… |
CVE-2024-13747 | Medium | 4.3 | 2025-03-05 | The WooMail - WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'template_d… |
CVE-2024-13232 | High | 8.8 | 2025-03-05 | The WordPress Awesome Import & Export Plugin - Import & Export WordPress Data plugin for WordPress is vulnerable arbitrary SQL Execution and privilege escalati… |
CVE-2024-8682 | Medium | 5.3 | 2025-03-05 | The JNews - WordPress Newspaper Magazine Blog AMP Theme theme for WordPress is vulnerable to unauthorized user registration in all versions up to, and includin… |
CVE-2025-27666 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Authorization Checks OVE-20230524-0010. |
CVE-2025-1307 | Critical | 9.8 | 2025-03-04 | The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_activate_plugin() fu… |
CVE-2025-1639 | High | 8.8 | 2025-03-04 | The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on th… |
CVE-2024-13686 | Medium | 4.3 | 2025-03-04 | The VW Storefront theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vw_storefront_reset_all_setti… |
CVE-2025-1891 | Medium | 4.3 | 2025-03-04 | A vulnerability was found in shishuocms 1.1 and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site req… |
CVE-2025-27270 | Critical | 9.8 | 2025-03-03 | Missing Authorization vulnerability in enituretechnology Residential Address Detection residential-address-detection allows Privilege Escalation.This issue aff… |
CVE-2025-23763 | Medium | 6.5 | 2025-03-03 | Missing Authorization vulnerability in Alex Volkov WAH Forms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WAH Fo… |
CVE-2025-23615 | Medium | 6.5 | 2025-03-03 | Missing Authorization vulnerability in gtekelis Interactive Page Hierarchy interactive-page-hierarchy allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-23613 | Medium | 6.5 | 2025-03-03 | Missing Authorization vulnerability in mediabeta WP Journal wpjournal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-23515 | Medium | 6.5 | 2025-03-03 | Missing Authorization vulnerability in tsecher ts-tree ts-tree allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ts-tr… |
CVE-2025-23440 | Medium | 6.3 | 2025-03-03 | Missing Authorization vulnerability in radicaldesigns radSLIDE radslide allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-24654 | High | 7.1 | 2025-03-03 | Missing Authorization vulnerability in SEO Squirrly SEO Plugin by Squirrly SEO squirrly-seo.This issue affects SEO Plugin by Squirrly SEO: from n/a through <=… |
CVE-2025-27583 | Critical | 9.1 | 2025-03-03 | Incorrect access control in the component /rest/staffResource/findAllUsersAcrossOrg of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) Eag… |
CVE-2025-25953 | Medium | 6.5 | 2025-03-03 | Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 was discovered to contain an Azure JWT access token exposure. This vulnera… |
CVE-2025-1813 | Medium | 4.3 | 2025-03-02 | A vulnerability classified as problematic was found in zj1983 zz up to 2024-08. Affected by this vulnerability is an unknown functionality. The manipulation le… |
CVE-2025-1404 | Medium | 5.3 | 2025-03-01 | The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t… |
CVE-2024-12544 | High | 8.8 | 2025-03-01 | The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to arbitrary fi… |
CVE-2025-1502 | Medium | 5.3 | 2025-03-01 | The IP2Location Redirection plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'download_ip2location_re… |
CVE-2024-13746 | Medium | 6.5 | 2025-03-01 | The Booking Calendar and Notification plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability check… |
CVE-2025-1780 | Medium | 4.3 | 2025-03-01 | The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing c… |
CVE-2024-13358 | Medium | 4.3 | 2025-03-01 | The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing c… |