← Back
CWE-306

2,604 CVEs • Abstraction: Base • Likelihood of Exploit: High

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

JSON object

Loading...

CVEs (2,604)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2009-1780
1Frax
1Php Recommend
Apr 23, 2026
May 22, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
admin.php in Frax.dk Php Recommend 1.3 and earlier does not require authentication when the user password is changed, which allows remote attackers to gain administrative privileges via modified form_admin_user and form_...Show more
admin.php in Frax.dk Php Recommend 1.3 and earlier does not require authentication when the user password is changed, which allows remote attackers to gain administrative privileges via modified form_admin_user and form_admin_pass parameters.Show less
CVE-2007-0956
3Canonical
DebianMit
3Debian Linux
Kerberos 5Ubuntu Linux
Apr 23, 2026
Apr 6, 2007
N/A· v4
N/A· v3
10.0 HIGH· v2
The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass authentication and gain system access via a username beginning with a '-' character, a similar issue to CVE-2007-0882.
CVE-2004-0213
1Microsoft
1Windows 2000
Apr 16, 2026
Aug 6, 2004
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
Utility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to gain system privileges via a "Shatter" style attack that sends a Windows message...Show more
Utility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to gain system privileges via a "Shatter" style attack that sends a Windows message to cause Utility Manager to launch winhlp32 by directly accessing the context sensitive help and bypassing the GUI, then sending another message to winhlp32 in order to open a user-selected file, a different vulnerability than CVE-2003-0908.Show less
CVE-2002-1810
1Dlink
1Dwl 900ap+ Firmware
Apr 16, 2026
Dec 31, 2002
N/A· v4
7.5 HIGH· v3
7.5 HIGH· v2
D-Link DWL-900AP+ Access Point 2.1 and 2.2 allows remote attackers to access the TFTP server without authentication and read the config.img file, which contains sensitive information such as the administrative password,...Show more
D-Link DWL-900AP+ Access Point 2.1 and 2.2 allows remote attackers to access the TFTP server without authentication and read the config.img file, which contains sensitive information such as the administrative password, the WEP encryption keys, and network configuration information.Show less