CWE-285 · Access Control
Improper Authorization
1,133CVEs
1exploited
9with a public check
10likely (EPSS 10%+)
SortMost likely exploited
1,133 CVEs with CWE-285 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2021-28799In CISA KEVExploitedQNAP HBS 3 - Broken Access ControlQNAP Systems Inc. · HBS 3 · CVSS 10 · 2021-05-13 | 10.0 | 78% | 2021-05-13 |
| CVE-2025-29927CheckNext.js Middleware Bypassvercel · next.js · CVSS 9.1 · 2025-03-21 | 9.1 | 99% | 2025-03-21 |
| CVE-2023-48241CheckXWiki < 4.10.15 - Information Disclosurexwiki · xwiki-platform · CVSS 7.5 · 2023-11-20 | 7.5 | 73% | 2023-11-20 |
| CVE-2023-22480CheckKubeOperator Foreground `kubeconfig` - File DownloadKubeOperator · KubeOperator · CVSS 7.3 · 2023-01-14 | 7.3 | 67% | 2023-01-14 |
| CVE-2023-2227CheckModoboa < 2.1.0 - Improper Authorizationmodoboa · modoboa/modoboa · CVSS 9.1 · 2023-04-21 | 9.1 | 44% | 2023-04-21 |
| CVE-2019-1898CheckCisco RV110W RV130W RV215W Router - Information leakageCisco · Cisco RV130W Wireless-N Multifunction VPN Router Firmware · CVSS 5.3 · 2019-06-20 | 5.3 | 41% | 2019-06-20 |
| CVE-2024-34257CheckTOTOLINK EX1800T TOTOLINK EX1800T - Command InjectionTotolink · Ex1800t Firmware · CVSS 9.8 · 2024-05-08 | 9.8 | 3.8% | 2024-05-08 |
| CVE-2026-10580CheckHippoo Mobile App for WooCommerce <= 1.9.4 - Authentication Bypass to Admin Account Takeoverhippooo · Hippoo Mobile App for WooCommerce · CVSS 9.8 · 2026-06-05 | 9.8 | 2.9% | 2026-06-05 |
| CVE-2025-1361CheckIP2Location Country Blocker < 2.38.9 - Unauthenticated Information Disclosureip2location · IP2Location Country Blocker · CVSS 7.5 · 2025-02-22 | 7.5 | 1.3% | 2025-02-22 |
| CVE-2024-26291CheckAvid NEXIS Agent - Arbitrary File ReadAvid · Avid NEXIS E-series · CVSS 8.7 · 2025-07-14 | 8.7 | 1.2% | 2025-07-14 |
| CVE-2023-32707‘edit_user’ Capability Privilege EscalationSplunk · Splunk Enterprise · CVSS 8.8 · 2023-06-01 | 8.8 | 79% | 2023-06-01 |
| CVE-2022-3229Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker can change or disable…Unified Intents AB · Unified Remote · CVSS 9.8 · 2023-02-06 | 9.8 | 66% | 2023-02-06 |
| CVE-2016-5676cgi-bin/cgi_system in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to reset the…Netgear · Readynas Surveillance · 2016-08-31 | – | 54% | 2016-08-31 |
| CVE-2025-21400Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft · Microsoft SharePoint Enterprise Server 2016 · CVSS 8 · 2025-02-11 | 8.0 | 34% | 2025-02-11 |
| CVE-2024-27937glpi Users emails enumerationglpi-project · glpi · CVSS 6.5 · 2024-03-18 | 6.5 | 27% | 2024-03-18 |
| CVE-2016-3352Microsoft Windows 8.1, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 do not properly check NTLM SSO requests for MSA logins, which makes it easier for remote attackers to de…Microsoft · Windows 10 · 2016-09-14 | – | 21% | 2016-09-14 |
| CVE-2023-50780Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeansApache Software Foundation · Apache ActiveMQ Artemis · CVSS 8.8 · 2024-10-14 | 8.8 | 17% | 2024-10-14 |
| CVE-2019-1912Cisco Small Business 220 Series Smart Switches Authentication Bypass VulnerabilityCisco · Cisco Small Business 220 Series Smart Plus Switches · CVSS 9.1 · 2019-08-07 | 9.1 | 17% | 2019-08-07 |
| CVE-2025-20125Cisco Identity Services Engine Insufficient Authorization Bypass VulnerabilityCisco · Cisco Identity Services Engine Software · CVSS 9.1 · 2025-02-05 | 9.1 | 16% | 2025-02-05 |
| CVE-2016-5420curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of th…Haxx · Libcurl · 2016-08-10 | – | 15% | 2016-08-10 |
| CVE-2016-5063The RSCD agent in BMC Server Automation before 8.6 SP1 Patch 2 and 8.7 before Patch 3 on Windows might allow remote attackers to bypass authorization checks and make an RPC call v…Bmc · Server Automation · 2017-05-02 | – | 8.4% | 2017-05-02 |
| CVE-2016-4531Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 does not invalidate credentials upon a logout action, which makes it easier for remote attackers to obtain access by le…Rockwellautomation · Factorytalk Energrymetrix · 2016-07-28 | – | 8.2% | 2016-07-28 |
| CVE-2017-11398A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an unauthenticated attacker to hijack a…Trend Micro · Trend Micro Smart Protection Server (Standalone) · 2018-01-19 | – | 8.2% | 2018-01-19 |
| CVE-2022-0993SiteGround Security <= 1.2.5 - Authorization Weakness to Authentication Bypasssiteground · Security Optimizer – The All-In-One Protection Plugin · CVSS 8.1 · 2022-04-19 | 8.1 | 7.5% | 2022-04-19 |
| CVE-2021-423384MOSAn GCB Doctor - Improper Authorization4MOSAn · GCB Doctor · CVSS 9.8 · 2021-11-19 | 9.8 | 5.8% | 2021-11-19 |
| CVE-2019-7489A vulnerability in SonicWall Email Security appliance allow an unauthenticated user to perform remote code execution. This vulnerability affected Email Security Appliance version…SonicWall · Email Security Appliance · 2019-12-23 | – | 5.3% | 2019-12-23 |
| CVE-2026-34222Open WebUI has Broken Access Control in Tool Valvesopen-webui · open-webui · CVSS 7.7 · 2026-04-01 | 7.7 | 5.1% | 2026-04-01 |
| CVE-2020-1745A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.…undertow-io · undertow · CVSS 8.6 · 2020-04-28 | 8.6 | 5.0% | 2020-04-28 |
| CVE-2025-29794Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft · Microsoft SharePoint Enterprise Server 2016 · CVSS 8.8 · 2025-04-08 | 8.8 | 4.9% | 2025-04-08 |
| CVE-2019-1897Cisco RV110W, RV130W, and RV215W Routers Denial of Service VulnerabilityCisco · Cisco RV130W Wireless-N Multifunction VPN Router Firmware · CVSS 5.3 · 2019-06-20 | 5.3 | 4.5% | 2019-06-20 |
| CVE-2017-6044An Improper Authorization issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4.0.11. Several files…Sierra Wireless · Sierra Wireless AirLink Raven XE and XT · 2017-06-30 | – | 4.3% | 2017-06-30 |
| CVE-2026-22252LibreChat MCP Stdio Remote Command Executiondanny-avila · LibreChat · CVSS 9.1 · 2026-01-12 | 9.1 | 4.2% | 2026-01-12 |
| CVE-2016-5799Moxa OnCell G3100V2 devices before 2.8 and G3111, G3151, G3211, and G3251 devices before 1.7 do not properly restrict authentication attempts, which makes it easier for remote att…Moxa · Oncell G3001 Firmware · 2016-08-24 | – | 4.0% | 2016-08-24 |
| CVE-2021-42126An improper authorization control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform privilege escalation.Ivanti · Ivanti Avalanche · 2021-12-07 | – | 4.0% | 2021-12-07 |
| CVE-2022-24894Symfony storing cookie headers in HttpCachesymfony · symfony · CVSS 5.9 · 2023-02-03 | 5.9 | 4.0% | 2023-02-03 |
| CVE-2024-51479Authorization bypass in Next.jsvercel · next.js · CVSS 7.5 · 2024-12-17 | 7.5 | 4.0% | 2024-12-17 |
| CVE-2023-21433Improper access control vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to install applications from Galaxy Store.Samsung Mobile · Galaxy Store · CVSS 7.8 · 2023-02-09 | 7.8 | 3.7% | 2023-02-09 |
| CVE-2022-21196Airspan Networks Mimosa Improper AuthorizationAirspan Networks · MMP · CVSS 10 · 2022-02-18 | 10.0 | 3.7% | 2022-02-18 |
| CVE-2016-9938An issue was discovered in Asterisk Open Source 11.x before 11.25.1, 13.x before 13.13.1, and 14.x before 14.2.1 and Certified Asterisk 11.x before 11.6-cert16 and 13.x before 13.…Digium · Asterisk · 2016-12-12 | – | 3.4% | 2016-12-12 |
| CVE-2019-1899Cisco RV110W, RV130W, and RV215W Routers Information Disclosure VulnerabilityCisco · Cisco RV130W Wireless-N Multifunction VPN Router Firmware · CVSS 5.3 · 2019-06-20 | 5.3 | 3.4% | 2019-06-20 |
| CVE-2014-6049phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter.Phpmyfaq · Phpmyfaq · 2018-08-28 | – | 3.2% | 2018-08-28 |
| CVE-2018-10861A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot image…Red Hat, Inc. · ceph · 2018-07-10 | – | 3.2% | 2018-07-10 |
| CVE-2017-16743An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remote unauthenticated at…Phoenixcontact · PHOENIX CONTACT FL SWITCH · 2018-01-12 | – | 3.1% | 2018-01-12 |
| CVE-2020-24674Improper Authorization in Symphony PlusABB · ABB Ability™ Symphony® Plus Operations · CVSS 8.8 · 2020-12-22 | 8.8 | 3.1% | 2020-12-22 |
| CVE-2021-25374An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in Android O(8.1) and below, and 3.9.00.9 in Android P(9.0) an…Samsung Mobile · Samsung Members · CVSS 8.6 · 2021-04-09 | 8.6 | 3.1% | 2021-04-09 |
| CVE-2019-13550In WebAccess, versions 8.4.1 and prior, an improper authorization vulnerability may allow an attacker to disclose sensitive information, cause improper control of generation of co…Advantech · WebAccess · 2019-09-18 | – | 2.8% | 2019-09-18 |
| CVE-2017-8409An issue was discovered on D-Link DCS-1130 devices. The device requires that a user logging to the device to provide a username and password. However, the device does not enforce…Dlink · Dcs-1130 Firmware · 2019-07-02 | – | 2.7% | 2019-07-02 |
| CVE-2018-0391A vulnerability in the password change function of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to cause the system to become inoperable. T…Cisco · Cisco Prime Collaboration Provisioning unknown · 2018-08-01 | – | 2.7% | 2018-08-01 |
| CVE-2019-14870All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing…Red Hat · samba · CVSS 5.4 · 2019-12-10 | 5.4 | 2.7% | 2019-12-10 |
| CVE-2017-7484It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not c…The PostgreSQL Global Development Group · PostgreSQL · 2017-05-12 | – | 2.6% | 2017-05-12 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.