CWE-862

Missing Authorization vulnerability in StackWC Order Listener for WooCommerce woc-order-alert allows Exploiting Incorrec

A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testin

SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX disp

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.4, there is a

@delmaredigital/payload-puck is a PayloadCMS plugin for integrating Puck visual page builder. Prior to 0.6.23, all /api/

phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS a

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attac

Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABLE=true (the default, and the N

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the 3gpp-pfd-manag

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the 3gpp-traffic-i

Budibase is an open-source low-code platform. Prior to 3.39.0, an anonymous attacker who knows or can enumerate a worksp

The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration bef

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobi

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modifi

Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An authorization bypass vulnerability in FUXA

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authori

Missing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Genera

ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 1

On SimStudio version below to 0.5.74, the `/api/auth/oauth/token` endpoint contains a code path that bypasses all author

Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupdate.cgi endpoint to

Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupload.cgi endpoint to

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restric

Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The I

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-a

Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the documents and files module does

The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to unauthorized account destruction in all versions up to,

Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control

Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe allows unrestricted Doctype acce

AlanWeb SCADA does not enforce authorization for some directories. This allows an unauthorized attacker to read all file

The LearnPress plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain an unauthenticated arbitrary file

The Create DB Tables plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.2.

In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoint

The mem0 v1.0.0 server lacks authentication and authorization controls for its memory reset functionality accessible via

The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.

The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enf

The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-gui

Missing Authorization vulnerability in Tomdever wpForo Forum allows Exploiting Incorrectly Configured Access Control Sec

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, PU

Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions.

Unauthenticated Broken Access Control in MetForm Pro <= 3.9.1 versions.

A vulnerability has been identified in the Feast Feature Server’s `/save-document` endpoint that allows an unauthenticat