CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- mayurik best employee management systemSourceCodester Best Employee Management System Administrative Endpoint View_user.php access control6.9 Medium
- microworld escan antivirus, escanav escan anti-virus +1 moreMicroWorld eScan Antivirus Quarantine Microworld default permission4.8 Medium
- pankajindevops scalepankajindevops scale API Endpoint access control5.3 Medium
- ibm iIBM i denial of service2.8 Low
- inspirythemes easy real estateWordPress Easy Real Estate plugin <= 2.2.6 - Privilege Escalation vulnerability9.8 Critical
- fave themes homey login registerWordPress Homey Login Register Plugin <= 2.4.0 - Privilege Escalation vulnerability9.8 Critical
- mosterd3d dd rolesWordPress DD Roles plugin <= 4.1 - Privilege Escalation vulnerability8.8 High
- fortinet fortianalyzer, fortianalyzer cloud, fortimanager +1 more +3 moreA incorrect privilege assignment in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.0...6.9 Medium
- fanli2012 native-php-cmsFanli2012 native-php-cms Backend sysconfig_doedit.php improper authorization6.9 Medium
- saad iqbal user managementWordPress User Management plugin <= 1.2 - Privilege Escalation vulnerability8.8 High
- red hat enterprise linux 10, enterprise linux 9, openshift container platform 4 +2 more +4 moreUsers: `root` appended to group listings7.1 High
- fortinet fortimanager, fortimanager cloud, fortianalyzer +1 more +3 moreA improper privilege management in Fortinet FortiManager version 7.4.0 through 7.4.3, 7.2.0...6.7 Medium
- singmr houserentSingMR HouseRent AdminController.java access control5.3 Medium
- avast antivirusREVE Antivirus reveinstall default permission8.5 High
- wander-chu springboot-blogwander-chu SpringBoot-Blog HTTP POST Request BaseInterceptor.java preHandle access control6.9 Medium
- zerowdd myblogZeroWdd myblog MyBlogMvcConfig.java permission6.9 Medium
- microworld escan antivirus, escanav escan anti-virus +1 moreMicroWorld eScan Antivirus Installation var default permission4.8 Medium
- allaccessible accessibility by allaccessibleWordPress Accessibility by AllAccessible plugin <= 1.3.4 - Privilege Escalation vulnerability8.8 High
- amentotech private limited wpguppyWordPress WPGuppy plugin <= 1.1.0 - Privilege Escalation vulnerability8.8 High
- themesawesome school management system – sakolawpSchool Management System – SakolaWP <= 1.0.8 - Unauthenticated Privilege Escalation9.8 Critical
- code-projects online shoe storecode-projects Online Shoe Store index.php access control6.9 Medium
- karmada-io karmadaKarmada PULL Mode Cluster Privilege Escalation8.7 High
- acronis cyber protect 16, cyber protect cloud agent +1 moreLocal privilege escalation due to excessive permissions assigned to Tray Monitor service. The...4.4 Medium
- beijing yunfan internet technology yunfan learning examination systemBeijing Yunfan Internet Technology Yunfan Learning Examination System doc.html improper authorization6.9 Medium
- d-link dir-816 a2, dlink dir-816 firmware +1 moreD-Link DIR-816 A2 form2NetSniper.cgi access control6.9 Medium
- d-link dir-816 a2, dlink dir-816 firmware +1 moreD-Link DIR-816 A2 ACL form2LocalAclEditcfg.cgi access control6.9 Medium
- d-link dir-816 a2, dlink dir-816 firmware +1 moreD-Link DIR-816 A2 IP QoS form2IPQoSTcAdd access control6.9 Medium
- d-link dir-816 a2, dlink dir-816 firmware +1 moreD-Link DIR-816 A2 DHCPD Setting form2Dhcpd.cgi access control6.9 Medium
- d-link dir-816 a2, dlink dir-816 firmware +1 moreD-Link DIR-816 A2 WiFi Settings form2AdvanceSetup.cgi access control6.9 Medium
- d-link dir-816 a2, dlink dir-816 firmware +1 moreD-Link DIR-816 A2 Virtual Service form2AddVrtsrv.cgi access control6.9 Medium
- d-link dir-816 a2, dlink dir-816 firmware +1 moreD-Link DIR-816 A2 DDNS Service access control6.9 Medium
- trend micro apex one, trend micro, inc. micro apex one, micro apex one as a service +2 moreA LogServer link following vulnerability in Trend Micro Apex One could allow a local attacker to...7.8 High
- trend micro apex one, trend micro, inc. micro apex one, micro apex one as a service +2 moreA LogServer link following vulnerability in Trend Micro Apex One could allow a local attacker to...7.8 High
- vibethemes wplms, wordpress learning management system +1 moreWordPress WPLMS plugin <= 1.9.9 - Unauthenticated Privilege Escalation vulnerability9.8 Critical
- vibethemes vibebpWordPress VibeBP plugin <= 1.9.9.4.1 - Unauthenticated Privilege Escalation vulnerability9.8 Critical
- mike leembruggen simple dashboardWordPress Simple Dashboard plugin <= 2.0 - Privilege Escalation vulnerability9.8 Critical
- ai magic magic, sunnykai ai magic +1 moreWordPress AI Magic – SEO Content Generator & Article Writer plugin <= 1.0.4 - Privilege Escalation vulnerability9.8 Critical
- ssl wireless sms notification, sslplugins ssl wireless sms notification +1 moreWordPress SSL Wireless SMS Notification plugin <= 3.6.0 - Privilege Escalation vulnerability9.8 Critical
- codeastro online food ordering systemCodeAstro Online Food Ordering System All Users Page all_users.php access control6.9 Medium
- d-link dir-823g, dlink dir-823g firmware +1 moreD-Link DIR-823G Web Management Interface HNAP1 SetVirtualServerSettings access control6.9 Medium
- teampassTeamPass mail_me operation authorization issue5.4 Medium
- teampassTeamPass does not properly check whether a folder is in a user's allowed folders list4.3 Medium
- qianfox foxcmsFoxCMS API Endpoint Site.php improper authorization6.9 Medium
- hashicorp nomad, nomad enterprise +1 moreNomad Allocations Vulnerable To Privilege Escalation Within A Namespace Using Unredacted Workload Identity Tokens6.5 Medium
- x1a0he adobe downloaderX1a0He Adobe Downloader XPC Service com.x1a0he.macOS.Adobe-Downloader.helper shouldAcceptNewConnection privileges management8.5 High
- fujifilm business innovation apeos c3070, apeos c5570, apeos c6580 +2 moreFujifilm Business Innovation Apeos C3070/Apeos C5570/Apeos C6580 Web Interface index.html#hashHome improper authorization6.9 Medium
- wpweb woocommerce pdf vouchersWordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Broken Authentication vulnerability9.8 Critical
- red hat advanced cluster management for kubernetes 2Open-cluster-management-io/ocm: cluster-manager permissions may allow a worker node to obtain service account tokens7.5 High
- classcmsClassCMS User Management Page admin insufficient privileges5.1 Medium
- straightvisions gmbh sv100 companionWordPress SV100 Companion plugin <= 2.0.02 - Privilege Escalation vulnerability9.8 Critical
- Show moreLoading…