Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
High 7.5
Incorrect access control in the Web management interface in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRo…
-
High 7.5
AG Life Logger Android App version v1.0.2.72 and before (package name com.donki.healthy), developed by IO FIT, K.K., co…
-
High 7.5
AdForest - Classified Android App version 4.0.12 (package name scriptsbundle.adforest), developed by Muhammad Jawad Ars…
-
High 7.5
mCarFix Motorists App version 2.3 (package name com.skytop.mcarfix), developed by Paniel Mwaura, contains improper acce…
-
High 7.5
TalkTalk 3.3.6 Android App contains improper access control vulnerabilities in multiple API endpoints. By modifying req…
-
High 7.5
Senza: Keto & Fasting Android App version 2.10.15 (package name com.gl.senza), developed by Paul Itoi, contains an impr…
-
High 7.5
Kanova Android App version 1.0.27 (package name com.karelane), developed by Karely L.L.C., contains improper access con…
-
High 7.5
ABC Fine Wine & Spirits Android App version v.11.27.5 and before (package name com.cta.abcfinewineandspirits), develope…
-
High 7.5
2nd Line Android App version v1.2.92 and before (package name com.mysecondline.app), developed by AutoBizLine, Inc., co…
-
High 7.8CVE-2025-61156 Public exploit
Incorrect access control in the kernel driver of ThreatFire System Monitor v4.7.0.53 allows attackers to escalate privi…
-
High 7.5
Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local netwo…
-
Medium 6.3
Sliver does not restricted traffic between Wireguard clients.
Sliver is a command and control framework that uses a custom Wireguard netstack. In versions 1.5.43 and earlier, and in development version 1.6.0-dev, the netstack does not limit traffic between Wireguard clients. This allows clients to communicate with each …
-
High 7.3
code-projects Simple Food Ordering System addproduct.php unrestricted upload
A security flaw has been discovered in code-projects Simple Food Ordering System 1.0. This issue affects some unknown processing of the file /addproduct.php. Performing manipulation of the argument photo results in unrestricted upload. The attack may be initi…
-
Medium 6.3
MaxSite CMS save-file-ajax.php unrestricted upload
A flaw has been found in MaxSite CMS up to 109. This issue affects some unknown processing of the file application/maxsite/admin/plugins/editor_files/save-file-ajax.php. Executing manipulation of the argument file_path/content can lead to unrestricted upload.…
-
Medium 6.3
MaxSite CMS HTTP Header uploads-require-maxsite.php unrestricted upload
A vulnerability was detected in MaxSite CMS up to 109. This vulnerability affects unknown code of the file application/maxsite/admin/plugins/auto_post/uploads-require-maxsite.php of the component HTTP Header Handler. Performing manipulation of the argument X-…
-
Medium 6.3
Yonyou U8 Cloud Request Header NCloudGatewayServlet unrestricted upload
A vulnerability has been found in Yonyou U8 Cloud up to 5.1sp. The impacted element is an unknown function of the file /service/NCloudGatewayServlet of the component Request Header Handler. Such manipulation of the argument ts/sign leads to unrestricted uploa…
-
High 7.5
Unauthorized modification of arbitrary articles vulnerability exists in blog-vue-springboot.
-
High 7.5CVE-2025-60800 Public exploit
Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to acc…
-
Medium 4.7
Willow CMS add unrestricted upload
A weakness has been identified in Willow CMS up to 1.4.0. Impacted is an unknown function of the file /admin/images/add. This manipulation causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the pu…
-
High 7.3
code-projects Simple Food Ordering System editproduct.php unrestricted upload
A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Impacted is an unknown function of the file /editproduct.php. Such manipulation of the argument photo leads to unrestricted upload. The attack can be launched remotel…
-
Medium 4.3
atjiu pybbs UserApiController.java information disclosure
A vulnerability was detected in atjiu pybbs up to 6.0.0. This affects an unknown function of the file UserApiController.java. The manipulation results in information disclosure. The attack may be launched remotely. The exploit is now public and may be used.
-
Medium 4.7
ashymuzuro Full-Ecommece-Website/Muzuro Ecommerce System Add Product index.php unrestricted upload
A vulnerability was found in ashymuzuro Full-Ecommece-Website and Muzuro Ecommerce System up to 1.1.0. This affects an unknown part of the file /admin/index.php?add_product of the component Add Product Page. The manipulation results in unrestricted upload. Th…
-
Medium 4.3
LearnHouse Image information disclosure
A vulnerability was detected in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. Affected by this issue is some unknown functionality of the component Image Handler. The manipulation results in information disclosure. The attack can be executed remo…
-
Medium 6.3
LearnHouse Course Thumbnail courses unrestricted upload
A vulnerability has been found in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. Impacted is an unknown function of the file /api/v1/courses/ of the component Course Thumbnail Handler. The manipulation of the argument thumbnail leads to unrestrict…
-
Medium 6.3
Bdtask Flight Booking Software Package Information package-information unrestricted upload
A vulnerability was detected in Bdtask Flight Booking Software up to 3.1. This affects an unknown part of the file /b2c/package-information of the component Package Information Module. The manipulation results in unrestricted upload. The attack can be launche…
-
Medium 6.3
Bdtask Flight Booking Software Deposit deposit unrestricted upload
A security vulnerability has been detected in Bdtask Flight Booking Software up to 3.1. Affected by this issue is some unknown functionality of the file /admin/transaction/deposit of the component Deposit Handler. The manipulation leads to unrestricted upload…
-
Medium 4.7
ajayrandhawa User-Management-PHP-MYSQL User Management edit-user.php unrestricted upload
A vulnerability was identified in ajayrandhawa User-Management-PHP-MYSQL up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This affects an unknown part of the file /admin/edit-user.php of the component User Management Interface. Such manipulation of the argumen…
-
Medium 5.3
Incorrect access control in the REST API endpoint of HubSpot v1.29441 allows unauthenticated attackers to view users' d…
-
Critical 9.1
An issue was discovered in eTimeTrackLite Web thru 12.0 (20250704). There is a permission control flaw that allows unau…
-
Medium 5.4
IDOR vulnerability in Educare ERP 1.0 (2025-04-22) allows unauthorized access to sensitive data via manipulated object …
-
High 8.8
An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Service does not require authentication. In …
-
Medium 6.5
An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service fails to authenticate request…
-
Medium 4.3
Tutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information Exposure
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.8.3. This makes it possible for authenticated attackers, with tutor-level access and above, to vi…
-
High 7.3
Azure Event Grid System Elevation of Privilege Vulnerability
Improper access control in Azure Event Grid allows an unauthorized attacker to elevate privileges over a network.
-
High 7.7
Azure Notification Service Elevation of Privilege Vulnerability
Improper access control in Azure Notification Service allows an authorized attacker to elevate privileges over a network.
-
High 7.2
Kottster app reinitialization can be re-triggered allowing command injection in development mode
Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode. This affects development mode only, production deployments w…
-
Medium 4.3
Moodle: external cohort search service leaks system cohort data
A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information from the system context, revealing restricted administrative data.
-
Medium 4.3
Moodle: course access permissions not properly checked in course_output_fragment_course_overview
A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses they should not have access to, potentially exposing limited course details.
-
High 7.2
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block Storage). The support…
-
Medium 5.9
Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.28, …