1480 matches found
PT-2025-12179
Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8 Description The issue allows attackers to view and delete any files due to improper access control. The application fails to verify whether the attacker is an administrator, enabling them to directly call th...
PT-2025-12342 · D Link · D-Link Dir-605L +1
Name of the Vulnerable Software and Affected Versions: D-Link DIR-618 versions 2.02/3.02 D-Link DIR-605L versions 2.02/3.02 Description: A vulnerability was found in the DDNS Service of the affected devices, specifically in the file /goform/formSetDDNS. This issue leads to improper access control...
Incorrect Authorization
Umbraco.Cms.Web.Backoffice is vulnerable to Incorrect Authorization. The vulnerability is due to improper access control due to manipulation of backoffice API URLs, allowing authenticated users to retrieve or delete restricted content...
CVE-2021-32584
An improper access control CWE-284 vulnerability in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.3 and below, version 8.2.7 to 8.2.4, version 8.1.3 may allow an unauthenticated and remote attacker to access certain areas of the web management CGI...
CVE-2025-26961 WordPress Fresh Framework plugin <= 1.70.0 - Unauthenticated Broken Access Control vulnerability
Missing Authorization vulnerability in FRESHFACE Fresh Framework fresh-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Fresh Framework: from n/a through = 1.70.0...
CVE-2025-2278
Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier allows an authenticated user to access information about these requests via a known request ID...
CVE-2025-25683
The aleksis-core package (the core of the AlekSIS framework) is vulnerable to Incorrect Access Control , allowing unauthenticated users to access sensitive PDF files. An attacker can trigger the generation of a PDF file, identify its ID via a GraphQL request , and then iterate through IDs to acce...
CVE-2025-28920
Missing Authorization vulnerability in Jogesh Responsive Google Map responsive-google-map allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Google Map: from n/a through = 3.1.5...
CVE-2025-28938 WordPress WP Performance Pack plugin <= 2.5.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Bjoern WP Performance Pack wp-performance-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Performance Pack: from n/a through = 2.5.3...
CVE-2025-23243
NVIDIA Riva contains a vulnerability where a user could cause an improper access control issue. A successful exploit of this vulnerability might lead to data tampering or denial of service...
CVE-2025-23243
NVIDIA Riva contains a vulnerability where a user could cause an improper access control issue. A successful exploit of this vulnerability might lead to data tampering or denial of service...
CVE-2025-23243
NVIDIA Riva contains a vulnerability where a user could cause an improper access control issue. A successful exploit of this vulnerability might lead to data tampering or denial of service...
CVE-2025-23243
NVIDIA Riva contains an improper access control vulnerability tracked as CVE-2025-23243 affecting NVIDIA Riva (riva_quickstart). Successful exploitation could lead to data tampering or denial of service. NVIDIA’s March 2025 security bulletin lists a mitigation: upgrade NVIDIA Riva on Linux to the...
CVE-2025-27436
CVE-2025-27436 affects SAP S/4HANA: Manage Bank Statements allows an authenticated user to delete the attachment of a posted bank statement due to missing access-control checks. Impact is low on integrity with no confidentiality or availability impact. Root cause described as insufficient authori...
PT-2025-10898 · Nvidia · Nvidia Riva
Name of the Vulnerable Software and Affected Versions: NVIDIA Riva affected versions not specified Description: The issue is related to improper access control, which could be exploited to cause data tampering or denial of service. Recommendations: At the moment, there is no information about a...
PT-2025-10897 · Nvidia · Nvidia Riva
Name of the Vulnerable Software and Affected Versions: NVIDIA Riva versions up to and including 2.18.0 Description: The issue is related to improper access control, which could lead to escalation of privileges, data tampering, denial of service, or information disclosure. A successful exploit of...
CVE-2025-2121 Thinkware Car Dashcam F800 Pro File Storage access control
A vulnerability classified as critical has been found in Thinkware Car Dashcam F800 Pro up to 20250226. Affected is an unknown function of the component File Storage. The manipulation leads to improper access controls. The attack can only be done within the local network. The exploit has been...
CVE-2025-25381
Incorrect access control in the KSRTC AWATAR app of Karnataka State Road Transport Corporation v1.3.0 allows to view sensitive information such as usernames and passwords...
CVE-2025-25617
The open-source school management software Unifiedtransform 2.X is vulnerable to Incorrect Access Control , which enables Privilege Escalation . Specifically, a user with Teacher privileges can access the /syllabus/create endpoint to create syllabus entries—a functionality intended exclusively fo...