CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- mist community edition, mist +1 moreMist Community Edition API Token views.py create_token access control6.9 Medium
- erzhongxmu jeewmsJeeWMS File filedeal.do filedeal access control5.3 Medium
- erzhongxmu jeewmsJeeWMS File generateController.do dogenerateOne2Many access control5.3 Medium
- erzhongxmu jeewmsJeeWMS File generateController.do dogenerate access control5.3 Medium
- devolutions serverImproper privilege assignment in PAM JIT privilege sets in Devolutions Server allows a PAM user...6.5 Medium
- erdogant pypickleerdogant pypickle pypickle.py save improper authorization4.8 Medium
- yangshare warehousemanager 仓库管理系统, warehouse management system +1 moreyangshare 技术杨工 warehouseManager 仓库管理系统 access control6.9 Medium
- quantumcloud simple business directory proWordPress Simple Business Directory Pro plugin < 15.6.9 - Privilege Escalation vulnerability9.8 Critical
- pebas couponxlWordPress CouponXL theme <= 4.5.0 - Privilege Escalation Vulnerability9.8 Critical
- arraytics eventinWordPress Eventin plugin <= 4.0.26 - Privilege Escalation Vulnerability9.8 Critical
- mojoomla hospital management systemWordPress Hospital Management System plugin <= 47.0(20-11-2023) - Privilege Escalation vulnerability8.8 High
- strangebee thehiveA Broken Access Control vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3...6.8 Medium
- cyberdavaAn issue was discovered in CyberDAVA before 1.1.20. A privilege escalation vulnerability allows a...6.4 Medium
- abup iot cloud platformABUP IoT Cloud Platform Incorrect Privilege Assignment5.9 Medium
- containerdcontainerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.4.6 Medium
- rocket apps wprojectWordPress wProject theme < 5.8.0 - Subscriber+ Privilege Escalation vulnerability8.8 High
- mojoomla wpamsWordPress WPAMS plugin <= 44.0 (17-08-2023) - Privilege Escalation vulnerability8.8 High
- contempo themes real estate 7WordPress Real Estate 7 theme <= 3.5.2 - Privilege Escalation vulnerability7.3 High
- ruoyiy_project RuoYi Offline Logout batchForceLogout improper authorization2.3 Low
- palo alto networks globalprotect app, globalprotect uwp app, paloaltonetworks globalprotect +2 moreGlobalProtect App on macOS: Non Admin User Can Disable the GlobalProtect App5.2 Medium
- opswat metadefender endpoint security sdkGlobalProtect App: Incorrect Privilege Management Vulnerability in OPSWAT MetaDefender Endpoint Security SDK7.1 High
- hashicorp nomad, nomad enterprise +1 moreNomad Vulnerable To Violation Of Mandatory Sentinel Policies in Nomad Job Submissions via Policy Override7.6 High
- siemens mendix oidc sso (mendix 10.12 compatible), mendix oidc sso (mendix 9 compatible), mendix oidc sso v4.2 (mendix 10 compatible) +1 more +3 moreA vulnerability has been identified in Mendix OIDC SSO (Mendix 10 compatible) (All versions < V4...2.1 Low
- project quay quay, red hat quay 3 +1 moreQuay: incorrect privilege assignment6.5 Medium
- ibm maximo application suiteIBM Maximo Application Suite privilege escalation7.5 High
- totolink a720r, a720r firmware +1 moreTOTOLINK A720R Log cstecgi.cgi access control6.9 Medium
- devolutions serverIncorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and...6.3 Medium
- brainstorm force ottokitWordPress SureTriggers <= 1.0.82 - Privilege Escalation Vulnerability9.8 Critical
- google androidIn multiple functions of RoleService.java, there is a possible permission squatting vulnerability...4.0 Medium
- macrozheng mallWeitong Mall Sale Endpoint improper authorization5.3 Medium
- macrozheng mallWeitong Mall Product Statistics queryTotal access control6.9 Medium
- macrozheng mallWeitong Mall Product History historyList access control6.9 Medium
- scriptandtools online-travling-system, online traveling system +1 moreScriptAndTools Online-Travling-System viewpackage.php access control6.9 Medium
- scriptandtools online-travling-system, online traveling system +1 moreScriptAndTools Online-Travling-System addpackage.php access control6.9 Medium
- scriptandtools online-travling-system, online traveling system +1 moreScriptAndTools Online-Travling-System addadvertisement.php access control6.9 Medium
- scriptandtools online-travling-system, online traveling system +1 moreScriptAndTools Online-Travling-System viewenquiry.php access control6.9 Medium
- 201206030 novel201206030 Novel Chapter AuthorController.java updateBookChapter access control5.3 Medium
- 201206030 novel-plus20120630 Novel-Plus LogController.java list improper authorization5.3 Medium
- 201206030 novel-plus20120630 Novel-Plus LogController.java deleteIndex improper authorization5.3 Medium
- wowjoy internet doctor workstation systemwowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System details improper authorization5.3 Medium
- wowjoy internet doctor workstation systemwowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System list improper authorization5.3 Medium
- iteachyou dreamer cmsiteachyou Dreamer CMS Attachment download improper authorization5.3 Medium
- itwanger paicodingitwanger paicoding Article post improper authorization5.3 Medium
- gl.inet gl-a1300 slate plus, gl-ar300m shadow, gl-ar300m16 shadow +20 more +22 moreGL.iNet GL-A1300 Slate Plus Download Interface improper authorization5.1 Medium
- aonetheme service finder bookingsService Finder Bookings <= 5.1 - Unauthenticated Privilege Escalation via 'nsl_registration_store_extra_input'9.8 Critical
- No product listedNETSCOUT nGeniusONE before 6.4.0 b2350 has a Weak Sudo Configuration.9.8 Critical
- baseweb jsitebaseweb JSite Apache Druid Monitoring Console index.html access control6.9 Medium
- projectopiaWordPress Projectopia plugin <= 5.1.24 - Privilege Escalation vulnerability9.8 Critical
- jauhari xelion xelion webchatWordPress Xelion Webchat plugin <= 9.1.0 - Privilege Escalation Vulnerability8.8 High
- totolink a3700r, a3700r firmware +1 moreTOTOLINK A3700R cstecgi.cgi setL2tpServerCfg access control6.9 Medium
- Show moreLoading…