CWE-285— Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.— MITRE CWE catalog

1,506 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-285page 17 of 31

CVE-2025-10821MEDIUMCVSS 4.3EG 4.3
2025-09-22
A flaw has been found in fuyang_lipengjun platform 1.0. The affected element is the function TopicCategoryController of the file /topiccategory/queryAll. This manipulation causes improper authorization. The attack is possible to be carried…
CVE-2025-10822MEDIUMCVSS 4.3EG 4.3
2025-09-23
A vulnerability has been found in fuyang_lipengjun platform 1.0. The impacted element is the function SysSmsLogController of the file /sys/smslog/queryAll. Such manipulation leads to improper authorization. The attack may be performed from…
CVE-2025-10902MEDIUMCVSS 4.3EG 4.3
2025-10-24
The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ai_scan_result_remove' function in all versions up to, and including, 1.0.15. This makes it possible fo…
CVE-2025-10947MEDIUMCVSS 5.3EG 5.3
2025-09-25
A flaw has been found in Sistemas Pleno Gestão de Locação up to 2025.7.x. The impacted element is an unknown function of the file /api/areacliente/pessoa/validarCpf of the component CPF Handler. Executing a manipulation of the argument …
CVE-2025-10976LOWCVSS 3.1EG 3.1
2025-09-25
A vulnerability was determined in JeecgBoot up to 3.8.2. This issue affects some unknown processing of the file /api/getDepartUserList. Executing manipulation of the argument departId can lead to improper authorization. The attack can be e…
CVE-2025-10977LOWCVSS 3.1EG 3.1
2025-09-25
A vulnerability was identified in JeecgBoot up to 3.8.2. Impacted is an unknown function of the file /sys/tenant/deleteBatch. The manipulation of the argument ids leads to improper authorization. The attack is possible to be carried out re…
CVE-2025-10978MEDIUMCVSS 4.3EG 4.3
2025-09-25
A security flaw has been discovered in JeecgBoot up to 3.8.2. The affected element is an unknown function of the file /sys/user/exportXls of the component Filter Handler. The manipulation results in improper authorization. The attack may b…
CVE-2025-10979MEDIUMCVSS 4.3EG 4.3
2025-09-25
A weakness has been identified in JeecgBoot up to 3.8.2. The impacted element is an unknown function of the file /sys/role/exportXls. This manipulation causes improper authorization. It is possible to initiate the attack remotely. The expl…
CVE-2025-10980MEDIUMCVSS 4.3EG 4.3
2025-09-26
A security vulnerability has been detected in JeecgBoot up to 3.8.2. This affects an unknown function of the file /sys/position/exportXls. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The…
CVE-2025-10981MEDIUMCVSS 4.3EG 4.3
2025-09-26
A vulnerability was detected in JeecgBoot up to 3.8.2. This impacts an unknown function of the file /sys/tenant/exportXls. Performing manipulation results in improper authorization. The attack can be initiated remotely. The exploit is now …
CVE-2025-10987MEDIUMCVSS 6.3EG 6.3
2025-09-26
A vulnerability was determined in YunaiV yudao-cloud up to 2025.09. Affected by this issue is some unknown functionality of the file /crm/contact/transfer of the component HTTP Request Handler. This manipulation of the argument contactId c…
CVE-2025-10988MEDIUMCVSS 6.3EG 6.3
2025-09-26
A vulnerability was identified in YunaiV ruoyi-vue-pro up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exp…
CVE-2025-10989MEDIUMCVSS 6.3EG 6.3
2025-09-26
A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This vulnerability affects unknown code of the file /system/role/authUser/selectAll. Performing manipulation of the argument userIds results in improper authorization.…
CVE-2025-10992MEDIUMCVSS 5.3EG 5.3
2025-09-26
A vulnerability was determined in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. Affected is an unknown function of the file /user/info/lookupList. Executing manipulation can lead to improper authorization. The attack ma…
CVE-2025-11030HIGHCVSS 7.3EG 7.3
2025-09-26
A vulnerability was detected in Tutorials-Website Employee Management System up to 611887d8f8375271ce8abc704507d46340837a60. Impacted is an unknown function of the file /admin/all-applied-leave.php of the component HTTP Request Handler. Th…
CVE-2025-11047MEDIUMCVSS 6.3EG 6.3
2025-09-26
A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file /module/Api/aluno. This manipulation of the argument aluno_id causes improper authorization. The attack may be initiated remotely…
CVE-2025-11048MEDIUMCVSS 6.3EG 6.3
2025-09-26
A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /consulta-dispensas. Such manipulation leads to improper authorization. The attack may be …
CVE-2025-11049MEDIUMCVSS 6.3EG 6.3
2025-09-27
A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /unificacao-aluno. Performing manipulation results in improper authorization. Remote exploitation of the attac…
CVE-2025-11050MEDIUMCVSS 6.3EG 6.3
2025-09-27
A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /periodo-lancamento. Executing manipulation can lead to improper authorization. The attack can be executed remotely. The exploit has been pub…
CVE-2025-11080MEDIUMCVSS 4.3EG 4.3
2025-09-27
A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4. This vulnerability affects the function selectStudentExamInfoList of the file src/main/java/com/education/api/controller/student/ExamInfoControlle…
CVE-2025-11174MEDIUMCVSS 5.3EG 5.3
2025-11-01
The Document Library Lite plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 1.1.6. This is due to the plugin exposing an unauthenticated AJAX action dll_load_posts which returns a JSON table…
CVE-2025-11227MEDIUMCVSS 6.5EG 6.5
2025-10-04
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 via the 'registerGetForm', 'registerGetForms', 'registerGetCampaign' and 'regis…
CVE-2025-11244LOWCVSS 3.7EG 3.7
2025-10-25
The Password Protected plugin for WordPress is vulnerable to authorization bypass via IP address spoofing in all versions up to, and including, 2.7.11. This is due to the plugin trusting client-controlled HTTP headers (such as X-Forwarded-…
CVE-2025-11256MEDIUMCVSS 5.3EG 5.3
2025-10-18
The Kognetiks Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated at…
CVE-2025-11272MEDIUMCVSS 5.4EG 5.4
2025-10-04
A vulnerability has been found in SeriaWei ZKEACMS up to 4.3. This affects the function Delete of the file src/ZKEACMS.Redirection/Controllers/UrlRedirectionController.cs of the component POST Request Handler. The manipulation leads to imp…
CVE-2025-11321MEDIUMCVSS 4.3EG 4.3
2025-10-06
A vulnerability was detected in zhuimengshaonian wisdom-education up to 1.0.4. The affected element is an unknown function of the file src/main/java/com/education/api/controller/student/WrongBookController.java. Performing manipulation of …
CVE-2025-11510MEDIUMCVSS 4.3EG 4.3
2025-10-18
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /filebird/v1/fb-wipe-clear-all-data function in all versions u…
CVE-2025-11521HIGHCVSS 8.1EG 8.1
2025-11-11
The Astra Security Suite – Firewall & Malware Scan plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient validation of remote URLs for zip downloads and an easily guessable key in all versions up to, and includ…
CVE-2025-11815MEDIUMCVSS 4.3EG 4.3
2025-11-21
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the uip_save_site_option() function in all versions up to,…
CVE-2025-11879MEDIUMCVSS 6.5EG 6.5
2025-10-25
The GenerateBlocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_option_rest' function in all versions up to, and including, 2.1.1. This makes it possible for authenticated …
CVE-2025-12005MEDIUMCVSS 4.3EG 4.3
2025-10-25
The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 8.5.41. This is due to the plugin not properly verifying that a …
CVE-2025-1226MEDIUMCVSS 5.3EG 5.3
2025-02-12
A vulnerability was found in ywoa up to 2024.07.03. It has been declared as critical. This vulnerability affects unknown code of the file /oa/setup/setup.jsp. The manipulation leads to improper authorization. The attack can be initiated re…
CVE-2025-12283MEDIUMCVSS 4.3EG 4.3
2025-10-27
A security flaw has been discovered in code-projects Client Details System 1.0. The impacted element is an unknown function. The manipulation results in authorization bypass. The attack can be launched remotely. The exploit has been releas…
CVE-2025-12288MEDIUMCVSS 4.3EG 4.3
2025-10-27
A vulnerability was detected in Bdtask Pharmacy Management System up to 9.4. Affected is an unknown function of the file /user/edit_user/ of the component User Profile Handler. Performing manipulation results in authorization bypass. Remot…
CVE-2025-12304MEDIUMCVSS 4.3EG 4.3
2025-10-27
A vulnerability has been found in dulaiduwang003 TIME-SEA-PLUS up to fb299162f18498dd9cf17da906886d80a077d53b. This affects the function alipayIsSucceed of the file PayController.java of the component Order Status Handler. The manipulation…
CVE-2025-12360MEDIUMCVSS 4.3EG 4.3
2025-11-06
The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to unauthorized API usage due to a missing capability check on the rtafar_ajax() function in all versions up to, and including, 1.7.7. This makes it …
CVE-2025-12367MEDIUMCVSS 4.3EG 4.3
2025-11-01
The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.3.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes…
CVE-2025-12435MEDIUMCVSS 5.4EG 5.4
2025-11-10
Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2025-12494MEDIUMCVSS 4.3EG 4.3
2025-11-15
The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajax_import_file function in all versions up to, and including, 2.12.28. This ma…
CVE-2025-12505MEDIUMCVSS 5.4EG 5.4
2025-12-06
The weDocs plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.1.14. This is due to the plugin not properly verifying that a user is authorized to perform an action in the create_item_permissio…
CVE-2025-12623LOWCVSS 3.1EG 3.1
2025-11-03
A vulnerability was identified in fushengqian fuint up to 41e26be8a2c609413a0feaa69bdad33a71ae8032. Affected by this issue is some unknown functionality of the file fuint-application/src/main/java/com/fuint/module/clientApi/controller/Clie…
CVE-2025-12720MEDIUMCVSS 5.3EG 5.3
2025-12-06
The g-FFL Cockpit plugin for WordPress is vulnerable to unauthorized modification of data due to IP-based authorization that can be spoofed in the handle_enqueue_only() function in all versions up to, and including, 1.7.1. This makes it po…
CVE-2025-12777MEDIUMCVSS 5.3EG 5.3
2025-11-19
The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.10.0. This is due to the plugin not properly verifying that a user is authorized to perform actions on the RES…
CVE-2025-12814MEDIUMCVSS 5.3EG 5.3
2025-11-19
The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to unauthorized modification of data due to n incorrect capability check on the siteseo_reset_settings function in all versions up to, and including, 1.3.2. This makes it po…
CVE-2025-12854LOWCVSS 3.7EG 3.7
2025-11-07
A vulnerability was identified in newbee-mall-plus up to 2.4.1. This vulnerability affects the function executeSeckill of the file /seckillExecution/. The manipulation of the argument userid leads to authorization bypass. It is possible to…
CVE-2025-12958LOWCVSS 2.7EG 2.7
2026-01-07
The Rankology SEO and Analytics Tool plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect capability check on the 'rankology_code_block' page in all versions up to, and including, 2.0. This makes it p…
CVE-2025-13085MEDIUMCVSS 4.3EG 4.3
2025-11-19
The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Improper Authorization leading to Sensitive Post Meta Disclosure in versions up to and including 1.3.2. This is due to missing object-level authorization checks in the re…
CVE-2025-13114MEDIUMCVSS 6.3EG 6.3
2025-11-13
A vulnerability was identified in macrozheng mall-swarm up to 1.0.3. This affects the function updateAttr of the file /cart/update/attr. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploi…
CVE-2025-13115MEDIUMCVSS 4.3EG 4.3
2025-11-13
A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. This impacts the function detail of the file /order/detail/ of the component Order Details Handler. Performing manipulation of the argument orderId results …
CVE-2025-13116MEDIUMCVSS 5.4EG 5.4
2025-11-13
A weakness has been identified in macrozheng mall-swarm and mall up to 1.0.3. Affected is the function cancelUserOrder of the file /order/cancelUserOrder. Executing manipulation of the argument orderId can lead to improper authorization. I…

Map vulnerabilities like CWE-285 to your infrastructure

EchelonGraph correlates every CVE — across CWE-285 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →