CWE-306

High likelihood

Missing Authentication for Critical Function

Parent: CWE-287 - Improper Authentication

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

2,426 vulnerabilities with CWE-306
CVE-2025-36757 MEDIUM
SolaX Cloud - Unauthenticated Administrator Login Bypass via Parameter Tampering
CVE-2025-36756 MEDIUM
SolaX Cloud - Unauthenticated Account Takeover via Serial Number
CVE-2025-7635 HIGH
Calix GigaCenter ONT 844E, 844G, 844GE, 854GE - Unauthenticated Telnet Root Access
CVSS 7.7
CVE-2025-9994 CRITICAL
Amp'ed RF BT-AP 111 - Info Disclosure
CVSS 9.8
CVE-2025-9160 HIGH
Rockwell Automation CompactLogix 5480 - Maintenance Menu Code Execution
CVE-2025-7970 HIGH
FactoryTalk Activation Manager 5.00.00-5.01.01 - Missing Authentication for Critical Function
CVSS 7.5
CVE-2025-42926 MEDIUM
SAP NetWeaver Application Server Java - Unauthenticated Sensitive Information Exposure via Internal File Access
CVSS 5.3
CVE-2025-58443 CRITICAL
fogproject < 1.5.10.1673 - Unauthenticated Database Dump via Authentication Bypass
CVSS 9.1
CVE-2025-7045 MEDIUM
Cloud SAML SSO plugin <1.0.19 - DoS
CVSS 6.5
CVE-2025-52551 CRITICAL
E2 Facility Management Systems - Unauthenticated File Operations
CVE-2025-9815 HIGH
alaneuler batteryKid < 2.1 - Improper Authentication in NSXPCListener
CVSS 7.8
CVE-2025-58318 MEDIUM
Delta Electronics DIAView - Auth Bypass
CVE-2025-7405 HIGH
Mitsubishi Electric Corporation MELSEC iQ-F Series CPU - Info Discl...
CVSS 7.3
CVE-2025-54942 CRITICAL
SUNNET Corporate Training Management System < 10.11 - Unauthenticated Access to Deployment Functionality
CVSS 9.8
CVE-2025-8861 CRITICAL
Changing TSA < 2025/2/6 - Unauthenticated Database Manipulation
CVSS 9.8
CVE-2025-55583 CRITICAL
D-Link DIR-868L B1 - Command Injection
CVSS 9.8
CVE-2025-30048 MEDIUM
CGM CLININET < 2025.MS2 - Unauthenticated Information Disclosure via serverConfig Endpoint
CVE-2025-30041 CRITICAL
CGM CLININET < 2025.MS1 - Unauthenticated Session ID Exposure via User Log Statistics Endpoints
CVE-2025-30040 CRITICAL
CGM CLININET < 2024.MS4 - Unauthenticated Sensitive Data Exposure via userlogxls.pl Endpoint
CVE-2025-30039 CRITICAL
CGM CLININET 2024.MS4 - Unauthenticated Session Takeover
CVE-2025-30037 HIGH
CGM CLININET 2025.MS2 - Unauthenticated Internal Endpoint Access
CVE-2025-25736 MEDIUM
Kapsch RIS-9260 RSU LEO - Unauthenticated Root Shell Access via ADB
CVSS 6.8
CVE-2025-8627 HIGH
TP-Link KP303 Firmware < 1.1.0 - Unauthenticated Protocol Command Injection
CVSS 8.8
CVE-2025-53118 CRITICAL
Securden Unified PAM 9.0-* < 11.3.1 - Unauthenticated Authentication Bypass via Administrator Backup Functions
CVSS 9.8
CVE-2025-55581 HIGH
D-Link DCS-825L <1.08.01 - Code Injection
CVSS 7.3
Details
Vulnerabilities 2,426
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits