← Back
CWE-862

9,867 CVEs • Abstraction: Class • Likelihood of Exploit: High

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

JSON object

Loading...

CVEs (9,867)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2025-9979
-
-
Jun 17, 2026
Sep 10, 2025
N/A· v4
4.3 MEDIUM· v3
N/A· v2
The Maspik plugin for WordPress is vulnerable to Missing Authorization in version 2.5.6 and prior. This is due to missing capability checks on the Maspik_spamlog_download_csv function. This makes it possible for authenti...Show more
The Maspik plugin for WordPress is vulnerable to Missing Authorization in version 2.5.6 and prior. This is due to missing capability checks on the Maspik_spamlog_download_csv function. This makes it possible for authenticated attackers, with subscriber-level access and above, to export and download the spam log database containing blocked submission attempts, which may include misclassified but legitimate submissions with sensitive data.Show less
CVE-2025-8778
-
-
Jun 17, 2026
Sep 10, 2025
N/A· v4
4.3 MEDIUM· v3
N/A· v2
The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the nitropack_set_compression_ajax() function in all versions up to, and including, 1.18.4. This...Show more
The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the nitropack_set_compression_ajax() function in all versions up to, and including, 1.18.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the nitropack-enableCompression option and effectively change plugin compression settings.Show less
CVE-2025-10040
-
-
Jun 17, 2026
Sep 10, 2025
N/A· v4
7.7 HIGH· v3
N/A· v2
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_ftp_details' AJAX action in all versions up to, and...Show more
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_ftp_details' AJAX action in all versions up to, and including, 7.27. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve a configured set of SFTP/FTP credentials.Show less
CVE-2025-49459
-
-
Jun 17, 2026
Sep 9, 2025
N/A· v4
7.8 HIGH· v3
N/A· v2
Missing authorization in the installer for Zoom Workplace for Windows on ARM before version 6.5.0 may allow an authenticated user to conduct an escalation of privilege via local access.
CVE-2025-58753
19001
1Copyparty
Jun 17, 2026
Sep 9, 2025
5.3 MEDIUM· v4
7.5 HIGH· v3
N/A· v2
Copyparty is a portable file server. In versions prior to 1.19.8, there was a missing permission-check in the shares feature (the `shr` global-option). When a share was created for just one file inside a folder, it was p...Show more
Copyparty is a portable file server. In versions prior to 1.19.8, there was a missing permission-check in the shares feature (the `shr` global-option). When a share was created for just one file inside a folder, it was possible to access the other files inside that folder by guessing the filenames. It was not possible to descend into subdirectories in this manner; only the sibling files were accessible. This issue did not affect filekeys or dirkeys. Version 1.19.8 fixes the issue.Show less
CVE-2025-59005
-
-
Jun 17, 2026
Sep 9, 2025
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in frenify Categorify categorify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Categorify: from n/a through <= 1.0.7.5.
CVE-2025-58981
-
-
Jun 17, 2026
Sep 9, 2025
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibi...Show more
Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Checker by Equalize Digital: from n/a through <= 1.31.0.Show less
CVE-2025-58980
-
-
Jun 17, 2026
Sep 9, 2025
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in recorp Export WP Page to Static HTML/CSS export-wp-page-to-static-html allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Export WP Page to Static HT...Show more
Missing Authorization vulnerability in recorp Export WP Page to Static HTML/CSS export-wp-page-to-static-html allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Export WP Page to Static HTML/CSS: from n/a through <= 4.1.0.Show less
CVE-2025-58979
-
-
Jun 17, 2026
Sep 9, 2025
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in BerqWP BerqWP searchpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BerqWP: from n/a through <= 2.2.53.
CVE-2025-58978
-
-
Jun 17, 2026
Sep 9, 2025
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in WP Swings PDF Generator for WordPress pdf-generator-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF Generator for WordPress: fr...Show more
Missing Authorization vulnerability in WP Swings PDF Generator for WordPress pdf-generator-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF Generator for WordPress: from n/a through <= 1.5.4.Show less
CVE-2025-58976
-
-
Jun 17, 2026
Sep 9, 2025
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibi...Show more
Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Checker by Equalize Digital: from n/a through <= 1.31.0.Show less
CVE-2025-53348
-
-
Jun 17, 2026
Sep 9, 2025
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Laborator Kalium kalium allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kalium: from n/a through <= 3.18.3.
CVE-2025-53340
-
-
Jun 17, 2026
Sep 9, 2025
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Retrieve Embedded Sensitive Data.This issue affects Awesome Support: from n/a through <= 6.3.6.
CVE-2025-53291
-
-
Jun 17, 2026
Sep 9, 2025
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in spoddev2021 Spreadconnect wc-spod.This issue affects Spreadconnect: from n/a through <= 2.1.5.
CVE-2025-49860
-
-
Jun 17, 2026
Sep 9, 2025
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support.This issue affects Majestic Support: from n/a through <= 1.1.0.
CVE-2025-39553
-
-
Jun 17, 2026
Sep 9, 2025
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 5.0.9.
CVE-2025-39541
-
-
Jun 17, 2026
Sep 9, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Roland Murg WP Simple Booking Calendar wp-simple-booking-calendar.This issue affects WP Simple Booking Calendar: from n/a through <= 2.0.13.
CVE-2025-32688
-
-
Jun 17, 2026
Sep 9, 2025
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Nebojsa Target Video Easy Publish brid-video-easy-publish.This issue affects Target Video Easy Publish: from n/a through <= 3.8.9.
CVE-2025-8712
1Ivanti
4Connect Secure
Neurons For Secure AccessPolicy Secure+1 more
Jun 17, 2026
Sep 9, 2025
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on...Show more
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure restricted settings.Show less
CVE-2025-55148
1Ivanti
4Connect Secure
Neurons For Secure AccessPolicy Secure+1 more
Jun 17, 2026
Sep 9, 2025
N/A· v4
7.6 HIGH· v3
N/A· v2
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on...Show more
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure restricted settings.Show less