Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
3,024 results · Feed
-
High 8.8
MDJM Event Management <= 1.7.8.4 - Authenticated (Subscriber+) Privilege Escalation via 'set-permissions' and 'change_role' Handlers
The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4. This is due to missing capability checks and nonce verification in the `MDJM_Permissions::set_permissions()` and `MDJM_Employee…
-
High 7.8CVE-2026-38764 Public exploit
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kern…
-
High 8.8
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thir…
-
High 8.8
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thir…
-
Critical 9.8
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thir…
-
High 8.0
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thir…
-
High 8.8
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thir…
-
Critical 9.9
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thir…
-
Critical 9.8
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thir…
-
Critical 10.0
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thir…
-
High 7.8
Authenticated local root privilege escalation vulnerability in openFT for Linux and Oracle Solaris
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for local privilege escalation to root of an already authenticated user on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtai…
-
High 7.5
Local Privilege Escalation in Gaia Portal
A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges.
-
High 8.8
Grav Login Plugin 3.8.11 Privilege Escalation via Profile Update
The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privil…
-
High 8.9
n8n before 2.29.8 and 2.30.1 Privilege Escalation via Token Exchange
n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. On instances where the Token Exchange feature and Public API are enabled, a low-privileged user who can obtai…
-
Medium 6.6
There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the …
-
High 8.8
Local Privilege Escalation in servereye client (sensorhub)
The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are vulnerable to Local Privilege Escalation. The high-privileged service SE3Recovery (EmergencyRecoveryService.exe), running as SYSTEM, periodi…
-
High 7.8CVE-2026-38765 Public exploit
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kern…
-
High 7.8CVE-2026-38766 Public exploit
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the sub_…
-
High 7.1
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll Year End). Supported ve…
-
High 7.8
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported ve…
-
High 7.2
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported ve…
-
High 8.8
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities). Suppo…
-
Medium 6.3
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll - General). Supported v…
-
Medium 6.3
Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Quality Workbench HTML system). Supp…
-
High 7.6
Vulnerability in the Oracle Advanced Planning Command Center product of Oracle E-Business Suite (component: Internal Op…
-
High 8.8
Vulnerability in the Oracle Yard Management product of Oracle E-Business Suite (component: Internal Operations). Suppor…
-
High 8.8
Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Sup…
-
High 7.5
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Supported v…
-
High 8.8
Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). …
-
High 8.8
Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations…
-
Medium 6.3
Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Lease Authoring…
-
High 8.3
Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Suppor…
-
High 8.8
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported vers…
-
High 8.2
Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operations). Supported ve…
-
Medium 6.3
Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operations). Supported ve…
-
High 8.8
Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Claim LOV). Supported versi…
-
High 7.2
Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Internal Operat…
-
High 8.8
Vulnerability in the TeleSales product of Oracle E-Business Suite (component: Internal Operations). Supported versions …
-
High 8.8
Vulnerability in the Oracle Payables product of Oracle E-Business Suite (component: Internal Operations). Supported ver…
-
High 8.8
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported …