88 matches found
CVE-2025-12351 Inadequate access control measure allows unauthorized users to access restricted administrative functions
Honeywell S35 Series Cameras contains an authorization bypass Vulnerability through User controller key. An attacker could potentially exploit this vulnerability, leading to Privilege Escalation to admin privileged functionalities . Honeywell also recommends updating to the most recent version of...
CVE-2025-6892
An Incorrect Authorization vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the API authentication mechanism allows unauthorized access to protected API endpoints, including those intended for administrative functions. This vulnerability can be...
Missing Authorization
Overview melisplatform/melis-core is a Melis Platform Core module Affected versions of this package are vulnerable to Missing Authorization via the /melis/MelisCore/ToolUser/addNewUser endpoint. An attacker can gain unauthorized administrative access by sending a crafted request to this endpoint...
EUVD-2018-8187
Malware in sbrugna...
EUVD-2025-25726
Malicious code in bioql PyPI...
The vulnerability of the sub_478D28 function in D-Link DI-7400G+ router microprogramming software allows a hacker to gain unauthorized access to the administrator interface.
The vulnerability of function sub478D28 in the D-Link DI-7400G+ router’s microprogramming system is related to the lack of measures taken to neutralize certain special elements. Exploiting this vulnerability can allow an intruder to gain unauthorized access to the administrator interface...
cups: Authentication Bypass in CUPS Authorization Handling
A flaw was found in CUPS, a widely used printing service on Linux and UNIX-like systems. The issue arises when authentication is configured to use a method other than Basic, but the attacker sends an HTTP request with a Basic authentication header. Due to improper validation in the cupsdAuthorize...
CVE-2025-52352
The Aikaan IoT management platform v3.25.0325-5-g2e9c59796 is vulnerable to an authentication bypass because the sign-up API endpoint remains functional even when the sign-up option is disabled in the user interface. This allows unauthenticated users to register new accounts via the API, potentia...
CVE-2025-55736
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, an arbitrary user can change his role to "admin", giving its relative privileges e.g. delete users, posts, comments etc.. The problem is in the routes/adminPanelUsers file...
CVE-2025-52392
Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. This vulnerability corresponds to...
CVE-2025-7768
Tigo Energy's Cloud Connect Advanced CCA device contains hard-coded credentials that allow unauthorized users to gain administrative access. This vulnerability enables attackers to escalate privileges and take full control of the device, potentially modifying system settings, disrupting solar...
Blue Access Cobalt X1 安全漏洞
Blue Access Cobalt X1 is an access control and access management system software from Blue Access USA. A security vulnerability exists in Blue Access Cobalt X1 02.000.187 and prior versions, which stems from an authentication bypass that could lead to unauthorized administrator access...
The vulnerability of the Telpo MDM mobile device management platform lies in its ability to disclose information through registration files. This allows a malicious actor to gain unauthorized access to the system with administrative rights and to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the Telpo MDM mobile device management platform lies in the ability to disclose information through registration files. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to the system with administrative privileges and compromise the...
CVE-2025-22252: Missing Authentication for Critical Function
A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker with knowledge of an existing admin account to access the device as a valid admin...
CVE-2024-4447
In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API UserSessionAjax.getSessionList.dwr calls. While this is information that would and should be available to admins who possess "Sign In As" powers, admins who otherwise lack...
CVE-2025-48695
CVE-2025-48695 affects CyberDAVA before 1.1.20. A privilege escalation flaw exists in the API endpoint /api/v2/users/user//role/ROLE/, where a low-privileged user can escalate to admin due to insufficient access control. The issue is reflected in multiple sources (NVD/CVE records) with a base sco...
CVE-2021-22729
A CWE-259: Use of Hard-coded Password vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and EVlink Smart Wallbox EVB1A all versions prior to R8 V3.4.0.1 that could allow an attacker to...
JMBroadcast JMB0150 Firmware 安全漏洞
JMBroadcast JMB0150 Firmware is a firmware from JMBroadcast. A security vulnerability exists in JMBroadcast JMB0150 Firmware version v1.0, which stems from improper access control of the HOME.php endpoint, which could lead to unauthorized access to the administration panel...
GHSA-322V-VH2G-QVPV Mattermost Fails to Restrict Certain Operations on System Admins
Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the "Edit Other Users" permission to perform unauthorized modifications to system...
