Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
100 results · Clear filters · Feed
-
High 7.2CVE-2025-52915 Public exploit
K7RKScan.sys 23.0.0.10, part of the K7 Security Anti-Malware suite, allows an admin-privileged user to send crafted IOC…
-
High 8.5CVE-2013-10052 Public exploit
ZPanel zsudo Local Privilege Escalation
ZPanel includes a helper binary named zsudo, intended to allow restricted privilege escalation for administrative tasks. However, when misconfigured in /etc/sudoers, zsudo can be invoked by low-privileged users to execute arbitrary commands as root. This flaw…
-
High 8.5CVE-2012-10022 Public exploit
Kloxo <= 6.1.12 Local Privilege Escalation
Kloxo versions 6.1.12 and earlier contain two setuid root binaries—lxsuexec and lxrestart—that allow local privilege escalation from uid 48. The lxsuexec binary performs a uid check and permits execution of arbitrary commands as root if the invoking user matc…
-
High 8.0CVE-2025-52289 Public exploit
A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privile…
-
High 8.5CVE-2016-15045 Public exploit
Deepin lastore-daemon Privilege Escalation via Unsigned .deb Installation
A local privilege escalation vulnerability exists in lastore-daemon, the system package manager daemon used in Deepin Linux (developed by Wuhan Deepin Technology Co., Ltd.). In versions 0.9.53-1 (Deepin 15.5) and 0.9.66-1 (Deepin 15.7), the D-Bus configuratio…
-
High 8.8CVE-2015-10139 Public exploit
WPLMS Learning Management System for WordPress, WordPress LMS <= 1.8.4.1 - Privilege Escalation
The WPLMS theme for WordPress is vulnerable to Privilege Escalation in versions 1.5.2 to 1.8.4.1 via the 'wp_ajax_import_data' AJAX action. This makes it possible for authenticated attackers to change otherwise restricted settings and potentially create a new…
-
High 8.2CVE-2025-53024 Public exploit
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
High 7.3CVE-2025-6759 Public exploit
Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges
Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Windows Virtual Delivery Agent for CVAD and Citrix DaaS
-
High 8.8CVE-2025-4601 Public exploit
RH - Real Estate WordPress Theme <= 4.4.0 - Authenticated (Subscriber+) Privilege Escalation
The "RH - Real Estate WordPress Theme" theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.0. This is due to the theme not properly restricting user roles that can be updated as part of the inspiry_update_profil…
-
High 8.8CVE-2024-57778 Public exploit
An issue in Orbe ONetView Roeador Onet-1200 Orbe 1680210096 allows a remote attacker to escalate privileges via the ser…
-
High 7.8CVE-2024-11467 Public exploit
Omnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a logic flaw. Success…
-
High 7.8CVE-2018-9375 Public exploit
In multiple functions of UserDictionaryProvider.java, there is a possible way to add and delete words in the user dicti…
-
High 8.8CVE-2024-24409 Public exploit
Privilege Escalation
Zohocorp ManageEngine ADManager Plus versions 7203 and prior are vulnerable to Privilege Escalation in the Modify Computers option.
-
High 8.1
Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalities
A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or sys…
-
High 8.1CVE-2024-45058 Public exploit
Privilege escalation in i-Educar
i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. Prior to the 2.9 branch, an attacker with only minimal viewing privileges in the settings section is able to change th…
-
High 7.8CVE-2024-34741 Public exploit
In setForceHideNonSystemOverlayWindowIfNeeded of WindowState.java, there is a possible way for message content to be vi…
-
High 7.4CVE-2024-31320 Public exploit
In setSkipPrompt of AssociationRequest.java , there is a possible way to establish a companion device association witho…
-
High 8.4
WhatsUp Gold SetAdminPassword Improper Access Control Privilege Escalation Vulnerability
In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows local attackers to modify admin's password.
-
High 7.2CVE-2024-34370 Public exploit
WordPress EAN for WooCommerce plugin <= 4.8.9 - Arbitrary Option Update to Privilege Escalation vulnerability
Improper Privilege Management vulnerability in WPFactory EAN for WooCommerce allows Privilege Escalation.This issue affects EAN for WooCommerce: from n/a through 4.8.9.
-
High 7.8CVE-2024-22774 Public exploit
An issue in Panoramic Corporation Digital Imaging Software v.9.1.2.7600 allows a local attacker to escalate privileges …
-
High 8.8CVE-2024-33775 Public exploit
An issue with the Autodiscover component in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a c…
-
High 7.8CVE-2024-27518 Public exploit
An issue in SUPERAntiSyware Professional X 10.0.1262 and 10.0.1264 allows unprivileged attackers to escalate privileges…
-
High 7.8CVE-2024-21111 Public exploit
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
High 7.6CVE-2024-28247 Public exploit
Pihole Authenticated Arbitrary File Read with root privileges
The Pi-hole is a DNS sinkhole that protects your devices from unwanted content without installing any client-side software. A vulnerability has been discovered in Pihole that allows an authenticated user on the platform to read internal server files arbitrari…
-
High 7.2
A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker can e…
-
High 7.8
Windows Error Reporting Service Elevation of Privilege Vulnerability
Windows Error Reporting Service Elevation of Privilege Vulnerability
KEV Jun 13, 2024 -
High 8.1CVE-2024-22752 Public exploit
Insecure permissions issue in EaseUS MobiMover 6.0.5 Build 21620 allows attackers to gain escalated privileges via use …
-
High 7.8CVE-2024-0197 Public exploit
Privilege Escalation in Thales SafeNet Sentinel HASP LDK
A flaw in the installer for Thales SafeNet Sentinel HASP LDK prior to 9.16 on Windows allows an attacker to escalate their privilege level via local access.
-
High 7.8CVE-2023-7016 Public exploit
Privilege Escalation in SafeNet Authentication Client
A flaw in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to execute code at a SYSTEM level via local access.
-
High 8.8
MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation
MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin`…
-
High 8.8CVE-2023-43317 Public exploit
An issue in Coign CRM Portal v.06.06 allows a remote attacker to escalate privileges via the userPermissionsList parame…
-
High 7.8CVE-2023-20598 Public exploit
An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOC…
-
High 8.8
In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the co…
KEV Sep 13, 2023 -
High 8.8CVE-2022-45451 Public exploit
Local privilege escalation due to insecure driver communication port permissions. The following products are affected: …
-
High 8.2CVE-2023-0872 Public exploit
ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users
The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizo…
-
High 8.8CVE-2023-30765 Public exploit
Delta Electronics InfraSuite Device Master Improper Access Control
Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contain improper access controls that could allow an attacker to alter privilege management configurations, resulting in privilege escalation.
-
High 8.8
ReviewX <= 1.6.13 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation
The ReviewX plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.13 due to insufficient restriction on the 'rx_set_screen_options' function. This makes it possible for authenticated attackers, with minimal permissio…
-
High 7.8CVE-2023-21987 Public exploit
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
High 7.7CVE-2023-1326 Public exploit
local privilege escalation in apport-cli
A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unprivileged users to run sudo apport-cli, less is configured as the pager, and the terminal size can be …
-
High 8.8
MinIO is vulnerable to privilege escalation on Linux/MacOS
Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attac…
KEV Sep 19, 2023