CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- nsstheme wp nssuser registerWordPress Wp NssUser Register plugin <= 1.0.0 - Privilege Escalation vulnerability9.8 Critical
- halim kh easy user settingsWordPress KH Easy User Settings plugin <= 1.0.0 - Privilege Escalation vulnerability8.8 High
- ce21 suite, ce21com ce21 suite +1 moreWordPress CE21 Suite plugin <= 2.2.0 - Privilege Escalation vulnerability9.8 Critical
- erzhongxmu jeewmsGuangzhou Huayi Intelligent Technology Jeewms Druid Monitoring Interface index.html improper authorization6.9 Medium
- shenzhen dashi tongzhou information technology agilebpmShenzhen Dashi Tongzhou Information Technology AgileBPM AuthorizationTokenCheckFilter.java doFilter access control5.3 Medium
- mayurik best house rental management systemSourceCodester Best House Rental Management System POST Request ajax.php improper authorization6.9 Medium
- ibm jazz foundationIBM Jazz Foundation improper access control5.3 Medium
- code4berry decoration management systemCode4Berry Decoration Management System User Permission user_permission.php5.3 Medium
- code4berry decoration management systemCode4Berry Decoration Management System User userregister.php permission5.3 Medium
- code4berry decoration management systemCode4Berry Decoration Management System User Image update_image.php access control5.3 Medium
- upkeeper solutions instant privilege access, instant privlege access +1 moreImproper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege...10.0 Critical
- upkeeper solutions instant privilege access, instant privlege access +1 moreImproper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege...10.0 Critical
- userplusWordPress UserPlus plugin <= 2.0 - Privilege Escalation vulnerability9.8 Critical
- altenergy power control softwareAltenergy Power Control Software database improper authorization6.9 Medium
- postgresql, debian linux +1 morePostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID4.2 Medium
- grafana labs oss and enterprisePrivilege escalation vulnerability for Organizations in Grafana5.1 Medium
- siemens spectrum power 7A vulnerability has been identified in Spectrum Power 7 (All versions < V24Q3). The affected...8.5 High
- sap host agentLocal Privilege Escalation in SAP Host Agent6.3 Medium
- mayurik hospital management systemSourceCodester Hospital Management System delete-account.php improper authorization5.3 Medium
- dell data domain operating system, powerprotect dd +1 moreDell PowerProtect Data Domain, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50,...6.8 Medium
- codezips free exam hall seating management systemCodezips Free Exam Hall Seating Management System save_user.php unrestricted upload5.3 Medium
- codezips online institute management systemCodezips Online Institute Management System profile.php unrestricted upload5.3 Medium
- codezips online institute management systemCodezips Online Institute Management System save_user.php unrestricted upload5.3 Medium
- totolink lr350, lr350 firmware +1 moreTOTOLINK LR350 formLoginAuth.htm authorization6.9 Medium
- matt whiteman bulk change roleWordPress Bulk Change Role plugin <= 1.1 - Privilege Escalation vulnerability8.8 High
- azexo marketing automation by azexoWordPress Marketing Automation by AZEXO plugin <= 1.27.80 - Privilege Escalation vulnerability8.8 High
- litespeed technologies cache, litespeedtech litespeed cache +1 moreWordPress LiteSpeed Cache plugin <= 6.5.1 - Privilege Escalation vulnerability8.1 High
- stack themes bstone demo importerWordPress Bstone Demo Importer plugin <= 1.0.1 - Privilege Escalation vulnerability8.8 High
- udit rawat exam matrixWordPress Exam Matrix plugin <= 1.5 - Privilege Escalation vulnerability9.8 Critical
- siemens intermesh 7177 hybrid 2.0 subscriber, intermesh 7707 fire subscriber, intermesh 7177 hybrid2.0 subscriber +1 more +3 moreA vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2...8.5 High
- gerry ntabuhashe gerryworks post by mail, gerryworks post by mail +1 moreWordPress GERRYWORKS Post by Mail plugin <= 1.0 - Privilege Escalation vulnerability8.8 High
- madiri salman aashish adding drop down roles in registration, user-drop-down-roles-in-registration +1 moreWordPress Adding drop down roles in registration plugin <= 1.1 - Privilege Escalation vulnerability9.8 Critical
- themexpo rs-membersWordPress RS-Members plugin <= 1.0.3 - Privilege Escalation vulnerability8.8 High
- codepassenger job board manager for wordpressWordPress Job Board Manager for WordPress plugin <= 1.0 - Privilege Escalation vulnerability9.8 Critical
- cyberlord92 miniorange otp verification with firebase, miniorange otp verification +1 moreMiniorange OTP Verification with Firebase <= 3.6.0 - Privilege Escalation via Registration due to Administrator Default User Role Value9.8 Critical
- hashicorp vault, vault enterprise, openbao +2 moreVault Operators in Root Namespace May Elevate Their Privileges7.2 High
- wpuserplus userplus, userplus user registration & user profile – userplus, user registration and user profile +2 moreUserPlus <= 2.0 - Authenticated (Editor+) Registration Form Update to Privilege Escalation7.2 High
- syracom secure loginThe Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows...5.4 Medium
- shilpi computers client dashboardMissing Authorization Vulnerability7.1 High
- elabftwUnauthorised granting of administrator privileges over arbitrary teams under certain circumstances8.6 High
- infinera tnms, nokia transcend network management system +1 moreThe WebDAV service in Infinera TNMS (Transcend Network Management System) 19.10.3 allows a low...9.0 Critical
- emlog, emlog pro project pro +1 moreA remote code execution (RCE) vulnerability in the component /admin/store.php of Emlog Pro before...6.3 Medium
- loadzilla loadlogicLoadZilla LLC LoadLogic v1.4.3 was discovered to contain insecure permissions vulnerability which allows a remote attacker to execute arbitrary code via the LogicLoadEc2DeployLambda and CredsGenFuncti…7.5 High
- oretnom23 online eyewear shopSourceCodester Online Eyewear Shop User Creation Users.php improper authorization5.3 Medium
- favethemes houzezWordPress Houzez theme <= 3.2.4 - Privilege Escalation vulnerability8.8 High
- favethemes houzez, houzez login register +1 moreWordPress Houzez Login Register plugin <= 3.2.5 - Privilege Escalation vulnerability8.8 High
- pickplugins post grid and gutenberg blocks, post grid +1 morePost Grid and Gutenberg Blocks 2.2.87 - 2.2.90 - Authenticated (Subscriber+) Privilege Escalation8.8 High
- ibm mq, mq operator, supplied mq advanced container images +2 moreIBM MQ security bypass7.5 High
- dell powerscale onefsDell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contains an incorrect privilege assignment...6.7 Medium
- hwameistorPotential Permission Leakage of Cluster Level in hwameistor2.8 Low
- Show moreLoading…