CWE-285

1,461 vulnerabilities with CWE-285

CVE-2025-64063 CRITICAL

Primakon Pi Portal 1.0.18 - Improper Authorization via Direct API Requests

CVSS 9.8

CVE-2025-64062 HIGH

Primakon Pi Portal 1.0.18 - Authenticated Privilege Escalation via Email Parameter Manipulation

CVSS 8.8

CVE-2025-13576 MEDIUM

code-projects Blog Site 1.0 - Incorrect Privilege Assignment in /admin.php

CVSS 6.3

CVE-2025-65107 MEDIUM

langfuse 2.95.0-2.95.11 and 3.17.0-3.130.0 - Authenticated Account Takeover via CSRF or Phishing Attack

CVSS 6.5

CVE-2025-11815 MEDIUM

UiPress lite < 3.5.08 - Authenticated Arbitrary Plugin Settings Modification via uip_save_site_option

CVSS 4.3

CVE-2025-64751 HIGH

OpenFGA 1.4.0-1.11.0 - Improper Authorization in Check and ListObject Calls

CVSS 8.8

CVE-2025-64655 HIGH

Dynamics OmniChannel SDK Storage Containers - Improper Authorization

CVSS 8.8

CVE-2025-65094 HIGH

WBCE CMS < 1.6.4 - Privilege Escalation via groups[] Parameter Manipulation

CVSS 8.8

CVE-2025-65033 HIGH

rallly < 4.5.4 - Authenticated Authorization Bypass in Poll Management

CVSS 8.1

CVE-2025-65031 MEDIUM

rallly < 4.5.4 - Authenticated User Impersonation via Comment AuthorName Field

CVSS 6.5

CVE-2025-65030 HIGH

rallly < 4.5.4 - Authenticated Authorization Bypass via Comment Deletion API

CVSS 7.1

CVE-2025-65029 HIGH

rallly < 4.5.4 - Authenticated Insecure Direct Object Reference in Participant Deletion Endpoint

CVSS 8.1

CVE-2025-65028 MEDIUM

rallly < 4.5.4 - Authenticated Insecure Direct Object Reference via ParticipantId Parameter

CVSS 6.5

CVE-2025-65021 CRITICAL

rallly < 4.5.4 - Authenticated Insecure Direct Object Reference via Poll Finalization

CVSS 9.1

CVE-2025-65020 MEDIUM

rallly < 4.5.4 - Authenticated Insecure Direct Object Reference via Poll Duplication Endpoint

CVSS 6.5

CVE-2025-63218 CRITICAL

Axel Technology WOLF1MS and WOLF2MS <=1.0.3 - Unauthenticated Admin Access

CVSS 9.8

CVE-2025-13085 MEDIUM

SiteSEO - WordPress <1.3.2 - Info Disclosure

CVSS 4.3

CVE-2025-12814 MEDIUM

SiteSEO - SEO Simplified <1.3.2 - Info Disclosure

CVSS 5.3

CVE-2025-12777 MEDIUM

YITH WooCommerce Wishlist <4.10.0 - Auth Bypass

CVSS 5.3

CVE-2025-12494 MEDIUM

Image Gallery - Photo Grid & Video Gallery <2.12.28 - Privilege Esc...

CVSS 4.3

CVE-2025-13118 MEDIUM

macrozheng mall and mall-swarm < 1.0.3 - Improper Authorization via OrderID Parameter

CVSS 6.3

CVE-2025-13117 MEDIUM

macrozheng mall and mall-swarm < 1.0.3 - Improper Authorization via Order Cancellation

CVSS 5.4

CVE-2025-13116 MEDIUM

macrozheng mall and mall-swarm < 1.0.3 - Improper Authorization via Order Cancellation

CVSS 5.4

CVE-2025-13115 MEDIUM

macrozheng mall and mall-swarm < 1.0.3 - Improper Authorization in Order Details Handler

CVSS 4.3

CVE-2025-13114 MEDIUM

macrozheng mall-swarm < 1.0.3 - Improper Authorization in Cart Update Attribute Function

CVSS 6.3