CWE-602 · Input Validation and Logic
Client-Side Enforcement of Server-Side Security
173CVEs
0exploited
0with a public check
0likely (EPSS 10%+)
SortMost likely exploited
173 CVEs with CWE-602 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2020-8162A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Content-Length of a direct…Rubyonrails · https://github.com/rails/rails · 2020-06-19 | – | 3.0% | 2020-06-19 |
| CVE-2024-23666A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData at least version 7.4.0 and 7.2.0 through 7.2.6 and 7.0.1 through 7.0.6 and 6.4.5 through 6.4.7…Fortinet · FortiManager · CVSS 7.1 · 2024-11-12 | 7.1 | 2.3% | 2024-11-12 |
| CVE-2014-2374Accuenergy Accuenergy Acuvim II Client-Side Enforcement of Server-Side SecurityAccuenergy · Accuenergy Acuvim II AXN-NET Ethernet module · CVSS 7.5 · 2014-11-05 | 7.5 | 1.9% | 2014-11-05 |
| CVE-2014-2373Accuenergy Accuenergy Acuvim II Client-Side Enforcement of Server-Side SecurityAccuenergy · Accuenergy Acuvim II AXN-NET Ethernet module · CVSS 7.5 · 2014-11-05 | 7.5 | 1.8% | 2014-11-05 |
| CVE-2023-42787A client-side enforcement of server-side security [CWE-602] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3…Fortinet · FortiAnalyzer · CVSS 6.2 · 2023-10-10 | 6.2 | 1.7% | 2023-10-10 |
| CVE-2025-51682mJobtime 15.7.2 handles authorization on the client side, which allows an attacker to modify the client-side code and gain access to administrative features. Additionally, they ca…Mjobtime · Mjobtime · CVSS 9.8 · 2025-12-01 | 9.8 | 1.7% | 2025-12-01 |
| CVE-2020-24683Authentication Bypass in Symphony PlusABB · ABB Ability™ Symphony® Plus Operations · CVSS 9.8 · 2020-12-22 | 9.8 | 1.5% | 2020-12-22 |
| CVE-2022-20658Cisco Unified Contact Center Management Portal and Unified Contact Center Domain Manager Privilege Escalation VulnerabilityCisco · Cisco Unified Contact Center Domain Manager · CVSS 9.6 · 2022-01-14 | 9.6 | 1.4% | 2022-01-14 |
| CVE-2017-12161It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker could use this flaw to…Red Hat, Inc. · Keycloak · 2018-02-21 | – | 1.3% | 2018-02-21 |
| CVE-2025-33024A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5…Siemens · RUGGEDCOM ROX MX5000 · CVSS 9.9 · 2025-05-13 | 9.9 | 1.3% | 2025-05-13 |
| CVE-2025-32469A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5…Siemens · RUGGEDCOM ROX MX5000 · CVSS 9.9 · 2025-05-13 | 9.9 | 1.3% | 2025-05-13 |
| CVE-2025-33025A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5…Siemens · RUGGEDCOM ROX MX5000 · CVSS 9.9 · 2025-05-13 | 9.9 | 1.3% | 2025-05-13 |
| CVE-2025-8792LitmusChaos Litmus client-side enforcement of server-side securityLitmusChaos · Litmus · CVSS 4.3 · 2025-08-10 | 4.3 | 1.2% | 2025-08-10 |
| CVE-2023-39218Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow a privileged user to enable information disclosure via network access.Zoom Video Communications, Inc. · Zoom Clients · CVSS 6.1 · 2023-08-08 | 6.1 | 1.1% | 2023-08-08 |
| CVE-2024-9844Insufficient server-side controls in Secure Application Manager of Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker to bypass restrictions.Ivanti · Connect Secure · CVSS 7.1 · 2024-12-10 | 7.1 | 1.0% | 2024-12-10 |
| CVE-2023-0704Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to bypass same origin policy and proxy settings via a crafted HTML pa…Google · Chrome · CVSS 6.5 · 2023-02-07 | 6.5 | 1.0% | 2023-02-07 |
| CVE-2017-14013A Client-Side Enforcement of Server-Side Security issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The log out function in the application removes the us…Prominent · ProMinent MultiFLEX M10a Controller · 2017-10-17 | – | 0.9% | 2017-10-17 |
| CVE-2021-21544Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. A remote authenticated malicious user with high privileges could potentially exploit…Dell · Integrated Dell Remote Access Controller (iDRAC) · CVSS 2.7 · 2021-04-30 | 2.7 | 0.9% | 2021-04-30 |
| CVE-2025-10640Missing Server-Side Authentication Checks in EfficientLab WorkExaminer ProfessionalEfficientLab · WorkExaminer Professional · CVSS 9.8 · 2025-10-21 | 9.8 | 0.9% | 2025-10-21 |
| CVE-2022-1525Cognex 3D-A1000 Dimensioning System Client-Side Enforcement of Server-Side SecurityCognex · 3D-A1000 Dimensioning System · CVSS 9.1 · 2022-09-06 | 9.1 | 0.9% | 2022-09-06 |
| CVE-2024-31491A client-side enforcement of server-side security vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6 allows attacker to execute unauthori…Fortinet · FortiSandbox · CVSS 8.6 · 2024-05-14 | 8.6 | 0.8% | 2024-05-14 |
| CVE-2022-3308Insufficient policy enforcement in developer tools in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML pag…Google · Chrome · CVSS 7.4 · 2022-11-01 | 7.4 | 0.8% | 2022-11-01 |
| CVE-2025-27681Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 mishandles Client Inter-process Security V-2022-004.Printerlogic · Vasion Print · CVSS 9.8 · 2025-03-05 | 9.8 | 0.8% | 2025-03-05 |
| CVE-2020-5345Dell EMC Unisphere for PowerMax versions prior to 9.1.0.17, Dell EMC Unisphere for PowerMax Virtual Appliance versions prior to 9.1.0.17, and PowerMax OS Release 5978 contain an a…Dell · Unisphere for PowerMax · CVSS 6.4 · 2020-06-23 | 6.4 | 0.7% | 2020-06-23 |
| CVE-2023-0581PrivateContent <= 8.4.3 - Protection Mechanism BypassLCWeb · PrivateContent · CVSS 5.3 · 2023-01-30 | 5.3 | 0.7% | 2023-01-30 |
| CVE-2026-54104U.S. GAO EPDS and CBCA EDS client-based privilege escalationGovernment Accountability Office · Electronic Protest Docketing System (EPDS) · CVSS 8.8 · 2026-06-18 | 8.8 | 0.7% | 2026-06-18 |
| CVE-2025-40591A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5…Siemens · RUGGEDCOM ROX MX5000 · CVSS 7.7 · 2025-06-10 | 7.7 | 0.7% | 2025-06-10 |
| CVE-2026-45274MyBooks: Unauthenticated Registration Bypass via Missing Server-Side ALLOW_REGISTER EnforcementPoxenStudio · talebook · CVSS 6.9 · 2026-08-19 | 6.9 | 0.7% | 2026-08-19 |
| CVE-2021-21531Dell Unisphere for PowerMax versions prior to 9.2.1.6 contain an Authorization Bypass Vulnerability. A local authenticated malicious user with monitor role may exploit this vulner…Dell · Unisphere for PowerMax · CVSS 8.1 · 2021-04-30 | 8.1 | 0.7% | 2021-04-30 |
| CVE-2023-23570Client-Side enforcement of Server-Side security for the Command Centre server could be bypassed and lead to invalid configuration with undefined behavior. This issue affects: Gall…Gallagher · Command Centre · CVSS 5.4 · 2023-12-18 | 5.4 | 0.7% | 2023-12-18 |
| CVE-2024-28029Client-Side Enforcement of Server-Side Security in Delta Electronics DIAEnergieDelta Electronics · DIAEnergie · CVSS 8.8 · 2024-03-21 | 8.8 | 0.7% | 2024-03-21 |
| CVE-2026-73267Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership checkRed Hat · multicluster engine for Kubernetes 2.10 · CVSS 7.7 · 2026-08-21 | 7.7 | 0.6% | 2026-08-21 |
| CVE-2022-3310Insufficient policy enforcement in custom tabs in Google Chrome on Android prior to 106.0.5249.62 allowed an attacker who convinced the user to install an application to bypass sa…Google · Chrome · CVSS 6.5 · 2022-11-01 | 6.5 | 0.6% | 2022-11-01 |
| CVE-2025-4527Dígitro NGC Explorer Password Transmission client-side enforcement of server-side securityDígitro · NGC Explorer · CVSS 3.7 · 2025-05-11 | 3.7 | 0.6% | 2025-05-11 |
| CVE-2024-52008Password Policy Bypass Vulnerability in Fides Webserverethyca · fides · CVSS 2 · 2024-11-26 | 2.0 | 0.6% | 2024-11-26 |
| CVE-2024-0701UserPro <= 5.1.6 - Disabled Membership Registration BypassUserproplugin · UserPro - Community and User Profile WordPress Plugin · CVSS 5.3 · 2024-02-05 | 5.3 | 0.6% | 2024-02-05 |
| CVE-2022-3047Insufficient policy enforcement in Extensions API in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to install a malicious extension to bypass downl…Google · Chrome · CVSS 6.5 · 2022-09-26 | 6.5 | 0.6% | 2022-09-26 |
| CVE-2026-63301Denial of Service in Quick.CMSOpenSolution · Quick.CMS · CVSS 7 · 2026-07-28 | 7.0 | 0.6% | 2026-07-28 |
| CVE-2024-12603A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password.TECNO · com.transsion.applock · CVSS 9.8 · 2024-12-13 | 9.8 | 0.6% | 2024-12-13 |
| CVE-2020-27268In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDana-i and AnyDana-A mobile applications a…Sooil · SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A · 2021-01-19 | – | 0.5% | 2021-01-19 |
| CVE-2026-89175Kingdom Communication Associated｜Smart Video Intercom System - Client-Side AuthenticationKingdom Communication Associated · EH3040 · CVSS 5.3 · 2026-09-11 | 5.3 | 0.5% | 2026-09-11 |
| CVE-2026-84841tsi-coop tsi-dpdp-cms client-side enforcement of server-side securitytsi-coop · tsi-dpdp-cms · CVSS 7.3 · 2026-09-02 | 7.3 | 0.5% | 2026-09-02 |
| CVE-2026-64813In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development sessionJetBrains · IntelliJ IDEA · CVSS 10 · 2026-07-23 | 10.0 | 0.5% | 2026-07-23 |
| CVE-2025-6025Order Tip for WooCommerce <= 1.5.4 - Unauthenticated Tip Manipulation to Negative Value Leading to Unauthorized Discountsrailmedia · Order Tip for WooCommerce · CVSS 7.5 · 2025-08-15 | 7.5 | 0.5% | 2025-08-15 |
| CVE-2025-665071Panel – CAPTCHA Bypass via Client-Controlled Flag1Panel-dev · 1Panel · CVSS 7.5 · 2025-12-09 | 7.5 | 0.5% | 2025-12-09 |
| CVE-2026-65051Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission HandlerSaturday Drive · Ninja Forms · CVSS 6.5 · 2026-07-21 | 6.5 | 0.5% | 2026-07-21 |
| CVE-2026-84110Releasit Releasit COD Form & Upsells OTP Validation client-side enforcement of server-side securityReleasit · Releasit COD Form & Upsells · CVSS 5.3 · 2026-09-01 | 5.3 | 0.5% | 2026-09-01 |
| CVE-2023-48789A client-side enforcement of server-side security in Fortinet FortiPortal version 6.0.0 through 6.0.14 allows attacker to improper access control via crafted HTTP requests.Fortinet · FortiPortal · CVSS 4.1 · 2024-06-03 | 4.1 | 0.5% | 2024-06-03 |
| CVE-2026-126085Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storagerails · rails · CVSS 5.3 · 2026-11-10 | 5.3 | 0.5% | 2026-11-10 |
| CVE-2026-23478Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callbackcalcom · cal.com · CVSS 10 · 2026-01-13 | 10.0 | 0.5% | 2026-01-13 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.