CWE-862 · Missing Authorization (page 58)
Page 58 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-10860 | Medium | 4.3 | 2025-02-28 | The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized submission of data due to a missing capability check on t… |
CVE-2024-9195 | High | 8.8 | 2025-02-28 | The WHMPress - WHMCS Client Area plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing… |
CVE-2024-13716 | Medium | 4.3 | 2025-02-28 | The Forex Calculators plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_settings_callback()… |
CVE-2025-1682 | High | 8.8 | 2025-02-28 | The Cardealer theme for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.4 due to missing capability check on the 'save_se… |
CVE-2025-1681 | Medium | 5.4 | 2025-02-28 | The Cardealer theme for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check and missing filename sa… |
CVE-2025-1745 | Medium | 4.3 | 2025-02-27 | A vulnerability has been found in LinZhaoguan pb-cms 2.0 and classified as problematic. This vulnerability affects unknown code of the component Logout. The ma… |
CVE-2025-22280 | High | 7.6 | 2025-02-27 | Missing Authorization vulnerability in revmakx DefendWP Firewall defend-wp-firewall allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-1249 | Medium | 5.3 | 2025-02-26 | Missing Authorization vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-1091 | Medium | 4.3 | 2025-02-26 | A Broken Authorization schema exists where any authenticated user could download IOA script and configuration files if the URL is known. |
CVE-2025-27000 | Medium | 5.4 | 2025-02-25 | Missing Authorization vulnerability in George Pattichis Simple Photo Feed simple-photo-feed allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-26995 | Medium | 5.4 | 2025-02-25 | Missing Authorization vulnerability in Anton Vanyukov Market Exporter market-exporter allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-26983 | Medium | 4.3 | 2025-02-25 | Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor recipe-card-blocks-by-wpzoom allows Exploiting Incorrectly Configure… |
CVE-2025-26975 | Medium | 5.3 | 2025-02-25 | Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Accessing Functionality Not Properly Constrained by ACLs.This is… |
CVE-2025-26960 | Medium | 6.5 | 2025-02-25 | Missing Authorization vulnerability in enituretechnology Small Package Quotes – Unishippers Edition small-package-quotes-unishippers-edition allows Exploiting… |
CVE-2025-26948 | Medium | 4.3 | 2025-02-25 | Missing Authorization vulnerability in NotFound Pie Register Premium. This issue affects Pie Register Premium: from n/a through 3.8.3.2. |
CVE-2025-26928 | Medium | 4.3 | 2025-02-25 | Missing Authorization vulnerability in Xfinitysoft Order Limit for WooCommerce wc-order-limit-lite allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-26871 | Medium | 4.3 | 2025-02-25 | Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2024-13693 | Medium | 5.3 | 2025-02-25 | The Enfold theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check in avia-export-class.php in all versions up to, a… |
CVE-2025-1644 | Medium | 4.3 | 2025-02-25 | A vulnerability classified as problematic has been found in Benner ModernaNet up to 1.2.0. Affected is an unknown function of the file /DadosPessoais/SG_Gravar… |
CVE-2025-1643 | Medium | 4.3 | 2025-02-25 | A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been rated as problematic. This issue affects some unknown processing of the file /DadosPess… |
CVE-2025-27356 | Medium | 5.4 | 2025-02-24 | Missing Authorization vulnerability in Hardik Sticky Header On Scroll sticky-header-on-scroll allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-27296 | High | 7.2 | 2025-02-24 | Missing Authorization vulnerability in revenueflex Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue revenueflex-easy-ads allows Exploiting Inc… |
CVE-2025-27294 | Medium | 4.8 | 2025-02-24 | Missing Authorization vulnerability in platcom WP-Asambleas wp-asambleas allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-26883 | Medium | 6.5 | 2025-02-24 | Missing Authorization vulnerability in bPlugins Animated Text Block animated-text-block allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-26764 | Medium | 6.5 | 2025-02-22 | Missing Authorization vulnerability in enituretechnology Distance Based Shipping Calculator distance-based-shipping-calculator allows Exploiting Incorrectly Co… |
CVE-2025-26750 | Medium | 6.5 | 2025-02-22 | Missing Authorization vulnerability in appsbd Vitepos vitepos-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects V… |
CVE-2025-1557 | Medium | 4.3 | 2025-02-22 | A vulnerability, which was classified as problematic, was found in OFCMS 1.1.3. Affected is an unknown function. The manipulation leads to cross-site request f… |
CVE-2025-1361 | High | 7.5 | 2025-02-22 | The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure in all versions up to, and including, 2.38.8 due to missing… |
CVE-2025-1402 | Medium | 5.3 | 2025-02-21 | The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ajax_ticket_delete… |
CVE-2025-1483 | Medium | 5.3 | 2025-02-20 | The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the e… |
CVE-2024-13520 | Medium | 5.3 | 2025-02-20 | The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to… |
CVE-2024-37363 | Medium | 6.5 | 2025-02-20 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. (CWE-862) Hitachi Vantara Pentaho… |
CVE-2025-0968 | Medium | 5.3 | 2025-02-19 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.0 due to a mis… |
CVE-2024-13364 | Medium | 5.3 | 2025-02-19 | The Raptive Ads plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the site_ads_files_reset() and cls_file_reset()… |
CVE-2024-13231 | Medium | 5.3 | 2025-02-19 | The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2024-13719 | Medium | 5.3 | 2025-02-19 | The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.9 via the invoic… |
CVE-2024-13468 | High | 7.5 | 2025-02-19 | The Trash Duplicate and 301 Redirect plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'duplicates-actio… |
CVE-2025-27013 | Medium | 5.3 | 2025-02-18 | Missing Authorization vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-22657 | High | 7.5 | 2025-02-18 | Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2024-13783 | Medium | 4.3 | 2025-02-18 | The FormCraft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in formcraft-main.php in all versions up to… |
CVE-2024-13316 | Medium | 5.3 | 2025-02-18 | The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to unautho… |
CVE-2024-13556 | High | 8.1 | 2025-02-18 | The Affiliate Links: WordPress Plugin for Link Cloaking and Link Management plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, a… |
CVE-2024-13687 | Medium | 4.3 | 2025-02-18 | The Team Builder – Meet the Team plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_team_bui… |
CVE-2024-13677 | High | 8.8 | 2025-02-18 | The GetBookingsWP – Appointments Booking Calendar Plugin For WordPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all v… |
CVE-2025-26773 | Medium | 4.3 | 2025-02-17 | Missing Authorization vulnerability in Adnan Analytify wp-analytify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-26765 | Medium | 5.4 | 2025-02-16 | Missing Authorization vulnerability in enituretechnology Distance Based Shipping Calculator distance-based-shipping-calculator allows Exploiting Incorrectly Co… |
CVE-2025-22291 | Medium | 5.3 | 2025-02-16 | Missing Authorization vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express Edition ltl-freight-quotes-worldwide-express-edition allows Exp… |
CVE-2025-22289 | Medium | 6.5 | 2025-02-16 | Missing Authorization vulnerability in enituretechnology LTL Freight Quotes – Unishippers Edition ltl-freight-quotes-unishippers-edition allows Exploiting Inco… |
CVE-2025-1358 | Medium | 4.3 | 2025-02-16 | A vulnerability classified as problematic was found in Pix Software Vivaz 6.0.10. This vulnerability affects unknown code. The manipulation leads to cross-site… |
CVE-2024-13439 | Medium | 4.3 | 2025-02-15 | The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the response() function… |
CVE-2024-13752 | Medium | 6.5 | 2025-02-15 | The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to unauthorized l… |
CVE-2025-0935 | Medium | 4.3 | 2025-02-15 | The Media Library Folders plugin for WordPress is vulnerable to unauthorized plugin settings change due to a missing capability check on several AJAX actions i… |
CVE-2024-13513 | Critical | 9.8 | 2025-02-15 | The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2… |
CVE-2025-24692 | High | 7.1 | 2025-02-14 | Missing Authorization vulnerability in M.Code Bulk Menu Edit bulk-menu-edit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-24607 | Medium | 5.8 | 2025-02-14 | Missing Authorization vulnerability in Northern Beaches Websites IdeaPush ideapush allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-23771 | Medium | 6.5 | 2025-02-14 | Missing Authorization vulnerability in Murali Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly… |
CVE-2025-23766 | Medium | 6.5 | 2025-02-14 | Missing Authorization vulnerability in ashamil OPSI Israel Domestic Shipments woo-ups-pickup allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-23534 | Medium | 6.5 | 2025-02-14 | Missing Authorization vulnerability in Mark Winiarski WPLingo wplingo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-22702 | Medium | 6.3 | 2025-02-14 | Missing Authorization vulnerability in ThemeGoods Photography photography allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-22698 | Medium | 6.3 | 2025-02-14 | Missing Authorization vulnerability in Ability, Inc Accessibility Suite online-accessibility allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2024-52500 | High | 7.2 | 2025-02-14 | Missing Authorization vulnerability in monetagwp Monetag Official Plugin monetag-official allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2024-13639 | Medium | 4.3 | 2025-02-13 | The Read More & Accordion plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the expmDeleteD… |
CVE-2024-13229 | Medium | 4.3 | 2025-02-13 | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on… |
CVE-2025-1214 | Medium | 6.3 | 2025-02-12 | A vulnerability classified as critical has been found in pihome-shc PiHome 2.0. This affects an unknown part of the file /user_accounts.php?uid of the componen… |
CVE-2025-26378 | High | 8.8 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged… |
CVE-2025-26377 | High | 8.1 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged… |
CVE-2025-26376 | Medium | 6.5 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged… |
CVE-2025-26375 | High | 8.8 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged… |
CVE-2025-26374 | Medium | 6.5 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (users endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticate… |
CVE-2025-26373 | Medium | 6.5 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (user endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated… |
CVE-2025-26372 | High | 7.1 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priv… |
CVE-2025-26371 | High | 8.8 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priv… |
CVE-2025-26370 | High | 7.1 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priv… |
CVE-2025-26369 | High | 8.8 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priv… |
CVE-2025-26368 | High | 8.1 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priv… |
CVE-2025-26367 | Medium | 4.3 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priv… |
CVE-2024-12296 | High | 8.8 | 2025-02-12 | The Apus Framework plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability ch… |
CVE-2024-13374 | Medium | 4.3 | 2025-02-12 | The WP Table Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on thewptm_getFolders AJAX action in all versi… |
CVE-2024-13800 | High | 8.1 | 2025-02-12 | The ConvertPlus plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check… |
CVE-2024-13769 | Medium | 6.4 | 2025-02-12 | The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capabilit… |
CVE-2024-13656 | High | 8.1 | 2025-02-12 | The Click Mag - Viral WordPress News Magazine/Blog Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of se… |
CVE-2024-13654 | High | 8.1 | 2025-02-12 | The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service… |
CVE-2024-13653 | High | 8.8 | 2025-02-12 | The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation… |
CVE-2024-12164 | Medium | 4.3 | 2025-02-12 | The WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon plugin for WordPress is vulnerable to unauthorized modification of data due to a missing c… |
CVE-2024-13554 | Medium | 5.3 | 2025-02-12 | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t… |
CVE-2024-13541 | Medium | 4.3 | 2025-02-12 | The aDirectory – WordPress Directory Listing Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the ad… |
CVE-2025-0526 | Medium | 5.4 | 2025-02-11 | In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. The field lacked validation w… |
CVE-2024-13643 | High | 8.8 | 2025-02-11 | The Zox News - Professional WordPress News & Magazine Theme plugin for WordPress is vulnerable to unauthorized data modification. This vulnerability can lead t… |
CVE-2025-25241 | Medium | 5.4 | 2025-02-11 | Due to a missing authorization check, an attacker who is logged in to application can view/ delete �My Overtime Requests� which could allow the attacker to acc… |
CVE-2025-23190 | Medium | 4.3 | 2025-02-11 | Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would othe… |
CVE-2025-23189 | Medium | 4.3 | 2025-02-11 | Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an authenticated attacker could generate technical meta-data. This l… |
CVE-2025-23187 | Medium | 5.3 | 2025-02-11 | Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an unauthenticated attacker could generate technical meta-data. This… |
CVE-2025-25167 | High | 8.2 | 2025-02-07 | Missing Authorization vulnerability in Black and White BookPress – For Book Authors book-press allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-25120 | Medium | 4.3 | 2025-02-07 | Missing Authorization vulnerability in Melodic Media Slide Banners slide-banners allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-25110 | Medium | 5.4 | 2025-02-07 | Missing Authorization vulnerability in Metagauss Event Kikfyre kikfyre-events-calendar-tickets allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-25081 | Medium | 4.2 | 2025-02-07 | Missing Authorization vulnerability in DeannaS Embed RSS embed-rss allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects E… |
CVE-2025-1084 | Medium | 4.3 | 2025-02-07 | A vulnerability, which was classified as problematic, has been found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected by this issue is some unknown functionalit… |
CVE-2025-1074 | Medium | 4.3 | 2025-02-06 | A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Affected is the function logout of the file /en/?mylogout of the compo… |
CVE-2025-20125 | Critical | 9.1 | 2025-02-05 | A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker with valid read-only credentials to obtain sensitive information, change n… |
CVE-2024-3976 | Medium | 6.5 | 2025-02-05 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from… |