CWE-285
CVEs classified under CWE-285, newest first.
474 CVEsRSS
CVE-2025-10988Medium· 6.3A vulnerability was identified in YunaiV ruoyi-vue-pro up to 2025.09
A vulnerability was identified in YunaiV ruoyi-vue-pro up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The e…
CVE-2025-10987Medium· 6.3A vulnerability was determined in YunaiV yudao-cloud up to 2025.09
A vulnerability was determined in YunaiV yudao-cloud up to 2025.09. Affected by this issue is some unknown functionality of the file /crm/contact/transfer of the component HTTP Request Handler. This manipulation of the argument contactId…
CVE-2025-11048Medium· 6.3A security vulnerability has been detected in Portabilis i-Educar up to 2.10
A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /consulta-dispensas. Such manipulation leads to improper authorization. The attack may b…
CVE-2025-11047Medium· 6.3A weakness has been identified in Portabilis i-Educar up to 2.10
A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file /module/Api/aluno. This manipulation of the argument aluno_id causes improper authorization. The attack may be initiated remote…
CVE-2025-11030High· 7.3A vulnerability was detected in Tutorials-Website Employee Management System up to 611887d8f8375271ce8abc704507d46340837a60
A vulnerability was detected in Tutorials-Website Employee Management System up to 611887d8f8375271ce8abc704507d46340837a60. Impacted is an unknown function of the file /admin/all-applied-leave.php of the component HTTP Request Handler. …
CVE-2025-10947Medium· 5.3A flaw has been found in Sistemas Pleno Gestão de Locação up to 2025.7.x
A flaw has been found in Sistemas Pleno Gestão de Locação up to 2025.7.x. The impacted element is an unknown function of the file /api/areacliente/pessoa/validarCpf of the component CPF Handler. Executing a manipulation of the argument p…
CVE-2025-10822Medium· 4.3A vulnerability has been found in fuyang_lipengjun platform 1.0
A vulnerability has been found in fuyang_lipengjun platform 1.0. The impacted element is the function SysSmsLogController of the file /sys/smslog/queryAll. Such manipulation leads to improper authorization. The attack may be performed fr…
CVE-2025-10821Medium· 4.3A flaw has been found in fuyang_lipengjun platform 1.0
A flaw has been found in fuyang_lipengjun platform 1.0. The affected element is the function TopicCategoryController of the file /topiccategory/queryAll. This manipulation causes improper authorization. The attack is possible to be carri…
CVE-2025-10820Medium· 4.3A vulnerability was detected in fuyang_lipengjun platform 1.0
A vulnerability was detected in fuyang_lipengjun platform 1.0. Impacted is the function TopicController of the file /topic/queryAll. The manipulation results in improper authorization. The attack can be executed remotely. The exploit is …
CVE-2025-10819Medium· 4.3A security vulnerability has been detected in fuyang_lipengjun platform 1.0
A security vulnerability has been detected in fuyang_lipengjun platform 1.0. This issue affects the function UserCouponController of the file /usercoupon/queryAll. The manipulation leads to improper authorization. Remote exploitation of …
CVE-2025-10278Medium· 6.3PoCYunaiV ruoyi-vue-pro transfer improper authorization
A flaw has been found in YunaiV ruoyi-vue-pro up to 2025.09. Impacted is an unknown function of the file /crm/contact/transfer. This manipulation of the argument ids/newOwnerUserId causes improper authorization. The attack is possible to…
CVE-2025-10276Medium· 6.3PoCYunaiV ruoyi-vue-pro transfer improper authorization
A security vulnerability has been detected in YunaiV ruoyi-vue-pro up to 2025.09. This vulnerability affects unknown code of the file /crm/contract/transfer. The manipulation of the argument id/newOwnerUserId leads to improper authorizat…
CVE-2025-10275Medium· 6.3PoCYunaiV yudao-cloud transfer improper authorization
A weakness has been identified in YunaiV yudao-cloud up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Executing a manipulation of the argument ids/newOwnerUserId can lead to improper authorization. The atta…
CVE-2025-10277Medium· 6.3PoCA vulnerability was detected in YunaiV yudao-cloud up to 2025.09
A vulnerability was detected in YunaiV yudao-cloud up to 2025.09. This issue affects some unknown processing of the file /crm/receivable/submit. The manipulation of the argument ID results in improper authorization. The attack can be exe…
CVE-2025-10209Medium· 5.4A security flaw has been discovered in Papermerge DMS up to 3.5.3
A security flaw has been discovered in Papermerge DMS up to 3.5.3. This issue affects some unknown processing of the component Authorization Token Handler. Performing manipulation results in improper authorization. The attack can be init…
CVE-2025-10073Medium· 4.3A vulnerability was determined in Portabilis i-Educar up to 2.10
A vulnerability was determined in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Api/turma. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The…
CVE-2023-21474Medium· 6.3Intent redirection vulnerability in SecSettings prior to SMR Apr-2022 Release 1 allows attackers to access arbitrary file with system privilege.
Intent redirection vulnerability in SecSettings prior to SMR Apr-2022 Release 1 allows attackers to access arbitrary file with system privilege.
CVE-2025-6431Medium· 6.5When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so
When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker could have bypassed this prompt, potentially exposing the user to security vulnerabilities or privac…
CVE-2024-8676High· 7.4A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it
A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead…
CVE-2024-6840Medium· 6.6Automation-controller: gain access to the k8s api server via job execution with container group
An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via `automountServiceAccountToken: true`, resu…
CVE-2024-23670High· 7.8An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands …
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands …
CVE-2024-23667High· 7.8An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands …
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands …
CVE-2023-5675Medium· 6.5Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these m…
CVE-2025-29927Critical· 9.1PoCNext.js middleware authorization bypass via x-middleware-subrequest
A crafted x-middleware-subrequest header lets an attacker skip Next.js middleware execution entirely, bypassing authentication/authorization checks implemented in middleware.