← Back
CWE-862

10,052 CVEs • Abstraction: Class • Likelihood of Exploit: High

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

JSON object

Loading...

CVEs (10,052)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2024-2544
1Sygnoos
1Popup Builder
Jun 17, 2026
Jun 15, 2024
N/A· v4
6.4 MEDIUM· v3
N/A· v2
The Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on all AJAX actions. This makes it possible for authenticated attackers, with s...Show more
The Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on all AJAX actions. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform multiple unauthorized actions, such as deleting subscribers, and importing subscribers to conduct stored cross-site scripting attacks.Show less
CVE-2023-6696
1Sygnoos
1Popup Builder
Jun 17, 2026
Jun 15, 2024
N/A· v4
8.1 HIGH· v3
N/A· v2
The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several functions in all ver...Show more
The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several functions in all versions up to, and including, 4.3.1. While some functions contain a nonce check, the nonce can be obtained from the profile page of a logged-in user. This allows subscribers to perform several actions including deleting subscribers and perform blind Server-Side Request Forgery.Show less
CVE-2024-37317
1Nextcloud
1Notes
Jun 17, 2026
Jun 14, 2024
N/A· v4
4.6 MEDIUM· v3
N/A· v2
The Nextcloud Notes app is a distraction free notes taking app for Nextcloud. If an attacker managed to share a folder called `Notes/` with a newly created user before they logged in, the Notes app would use that folder...Show more
The Nextcloud Notes app is a distraction free notes taking app for Nextcloud. If an attacker managed to share a folder called `Notes/` with a newly created user before they logged in, the Notes app would use that folder store the personal notes. It is recommended that the Nextcloud Notes app is upgraded to 4.9.3.Show less
CVE-2024-37314
1Nextcloud
1Nextcloud Server
Jun 17, 2026
Jun 14, 2024
N/A· v4
3.5 LOW· v3
N/A· v2
Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommended that the Nextcloud Server is upgraded to 25.0.7 or 26.0.2 and the Nextcloud Enterprise Server is u...Show more
Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommended that the Nextcloud Server is upgraded to 25.0.7 or 26.0.2 and the Nextcloud Enterprise Server is upgraded to 25.0.7 or 26.0.2.Show less
CVE-2023-51376
1Brainstormforce
1Surefeedback
Jun 17, 2026
Jun 14, 2024
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Brainstorm Force ProjectHuddle Client Site.This issue affects ProjectHuddle Client Site: from n/a through 1.0.34.
CVE-2024-5685
1Snipeitapp
1Snipe It
Jun 17, 2026
Jun 14, 2024
N/A· v4
8.1 HIGH· v3
N/A· v2
Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.
CVE-2024-23504
1Wpmanageninja
1Ninja Tables
Jun 17, 2026
Jun 14, 2024
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.5.
CVE-2023-51497
1Woocommerce
1Shipping Multiple Addresses
Jun 17, 2026
Jun 14, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Woo WooCommerce Ship to Multiple Addresses.This issue affects WooCommerce Ship to Multiple Addresses: from n/a through 3.8.9.
CVE-2023-51496
1Woocommerce
1Returns And Warranty Requests
Jun 17, 2026
Jun 14, 2024
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.2.7.
CVE-2023-51495
1Woocommerce
1Returns And Warranty Requests
Jun 17, 2026
Jun 14, 2024
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.2.7.
CVE-2023-51377
1Wpeverest
1Everest Forms
Jun 17, 2026
Jun 14, 2024
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in WPEverest Everest Forms.This issue affects Everest Forms: from n/a through 2.0.3.
CVE-2024-1094
-
-
Jun 17, 2026
Jun 14, 2024
N/A· v4
7.3 HIGH· v3
N/A· v2
The Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the make_st...Show more
The Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the make_staff() function in all versions up to, and including, 1.0.21. This makes it possible for unauthenticated attackers to grant users staff permissions. CVE-2024-37427 is likely a duplicate of this issue.Show less
CVE-2023-51523
-
-
Jun 17, 2026
Jun 14, 2024
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in WriterSystem WooCommerce Easy Duplicate Product.This issue affects WooCommerce Easy Duplicate Product: from n/a through 0.3.0.7.
CVE-2023-51516
1Businessdirectoryplugin
1Business Directory
Jun 17, 2026
Jun 14, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Business Directory Team Business Directory Plugin.This issue affects Business Directory Plugin: from n/a through 6.3.9.
CVE-2023-51507
1Expresstech
1Quiz And Survey Master
Jun 17, 2026
Jun 14, 2024
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.16.
CVE-2023-37394
1Wp Dummy Content Generator Project
1Wp Dummy Content Generator
Jun 17, 2026
Jun 14, 2024
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Deepak anand WP Dummy Content Generator.This issue affects WP Dummy Content Generator: from n/a through 2.3.0.
CVE-2023-36695
1Maximeschoeni
1Sublanguage
Jun 17, 2026
Jun 14, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
Missing Authorization vulnerability in Maxime Schoeni Sublanguage.This issue affects Sublanguage: from n/a through 2.9.
CVE-2023-36694
-
-
Jun 17, 2026
Jun 14, 2024
N/A· v4
6.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Bryan Lee Kingkong Board.This issue affects Kingkong Board: from n/a through 2.1.0.2.
CVE-2023-36504
1Bbsetheme
1Bbs E Popup
Jun 17, 2026
Jun 14, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Missing Authorization vulnerability in BBS e-Theme BBS e-Popup.This issue affects BBS e-Popup: from n/a through 2.4.5.
CVE-2023-35045
-
-
Jun 17, 2026
Jun 14, 2024
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Fat Rat Fat Rat Collect.This issue affects Fat Rat Collect: from n/a through 2.6.7.