CWE-266— Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.— MITRE CWE catalog
1,307 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-266page 19 of 27
- CVE-2025-10247MEDIUMCVSS 6.3EG 6.32025-09-11
A security vulnerability has been detected in JEPaaS 7.2.8. This vulnerability affects the function doFilterInternal of the component Filter Handler. Such manipulation leads to improper access controls. The attack can be executed remotely.…
- CVE-2025-10086MEDIUMCVSS 6.3EG 6.32025-09-08
A weakness has been identified in fuyang_lipengjun platform 1.0.0. This issue affects the function queryAll of the file /adposition/queryAll of the component AdPositionController. This manipulation causes improper authorization. The attack…
- CVE-2025-10072MEDIUMCVSS 6.3EG 6.32025-09-07
A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /matricula/[ID_STUDENT]/enturmar/. Performing a manipulation results in improper access controls. It is possible to initiat…
- CVE-2025-10071MEDIUMCVSS 6.3EG 6.32025-09-07
A vulnerability has been found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /cancelar-enturmacao-em-lote/. Such manipulation leads to improper access controls. The attack may be performed from remo…
- CVE-2025-10070MEDIUMCVSS 6.3EG 6.32025-09-07
A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /enturmacao-em-lote/. This manipulation causes improper access controls. The attack is possible to be carried out remotely. The exploit has b…
- CVE-2025-10013MEDIUMCVSS 6.3EG 6.32025-09-05
A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /exportacao-para-o-seb. Performing a manipulation results in improper access controls. The attack is possible to be carried out re…
- CVE-2025-9151MEDIUMCVSS 6.3EG 6.32025-08-19
A security flaw has been discovered in LiuYuYang01 ThriveX-Blog up to 3.1.7. Affected by this vulnerability is the function updateJsonValueByName of the file /web_config/json/name/web. Performing manipulation results in improper authorizat…
- CVE-2025-8791MEDIUMCVSS 6.3EG 6.32025-08-10
A vulnerability was found in LitmusChaos Litmus up to 3.19.0. It has been rated as critical. This issue affects some unknown processing of the file /auth/list_projects. The manipulation of the argument role leads to improper authorization.…
- CVE-2025-7552MEDIUMCVSS 6.3EG 6.32025-07-14
A vulnerability was found in Dromara Northstar up to 7.3.5. It has been rated as critical. Affected by this issue is the function preHandle of the file northstar-main/src/main/java/org/dromara/northstar/web/interceptor/AuthorizationInterce…
- CVE-2025-0139MEDIUMCVSS 6.3EG 6.32025-07-09
An incorrect privilege assignment vulnerability in Palo Alto Networks Autonomous Digital Experience Manager allows a locally authenticated low privileged user on macOS endpoints to escalate their privileges to root.
- CVE-2025-5429MEDIUMCVSS 6.3EG 6.32025-06-02
A vulnerability classified as critical was found in juzaweb CMS up to 3.4.2. This vulnerability affects unknown code of the file /admin-cp/plugin/install of the component Plugins Page. The manipulation leads to improper access controls. Th…
- CVE-2025-5428MEDIUMCVSS 6.3EG 6.32025-06-02
A vulnerability classified as critical has been found in juzaweb CMS up to 3.4.2. This affects an unknown part of the file /admin-cp/log-viewer of the component Error Logs Page. The manipulation leads to improper access controls. It is pos…
- CVE-2025-5427MEDIUMCVSS 6.3EG 6.32025-06-02
A vulnerability was found in juzaweb CMS up to 3.4.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin-cp/permalinks of the component Permalinks Page. The manipulation leads to improper…
- CVE-2025-5426MEDIUMCVSS 6.3EG 6.32025-06-02
A vulnerability was found in juzaweb CMS up to 3.4.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin-cp/menus of the component Menu Page. The manipulation leads to improper a…
- CVE-2025-5425MEDIUMCVSS 6.3EG 6.32025-06-02
A vulnerability was found in juzaweb CMS up to 3.4.2. It has been classified as critical. Affected is an unknown function of the file /admin-cp/theme/editor/default of the component Theme Editor Page. The manipulation leads to improper acc…
- CVE-2025-5424MEDIUMCVSS 6.3EG 6.32025-06-02
A vulnerability was found in juzaweb CMS up to 3.4.2 and classified as critical. This issue affects some unknown processing of the file /admin-cp/media of the component Media Page. The manipulation leads to improper access controls. The at…
- CVE-2025-5423MEDIUMCVSS 6.3EG 6.32025-06-02
A vulnerability has been found in juzaweb CMS up to 3.4.2 and classified as critical. This vulnerability affects unknown code of the file /admin-cp/setting/system/general of the component General Setting Page. The manipulation leads to imp…
- CVE-2025-5421MEDIUMCVSS 6.3EG 6.32025-06-02
A vulnerability, which was classified as critical, has been found in juzaweb CMS up to 3.4.2. Affected by this issue is some unknown functionality of the file /admin-cp/plugin/editor of the component Plugin Editor Page. The manipulation le…
- CVE-2025-3517MEDIUMCVSS 6.3EG 6.32025-05-01
Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a previously configured user configured in a PAM JIT account via failure to update the internal account��…
- CVE-2025-4036MEDIUMCVSS 6.3EG 6.32025-04-28
A vulnerability was found in 201206030 Novel 3.5.0 and classified as critical. This issue affects the function updateBookChapter of the file src/main/java/io/github/xxyopen/novel/controller/author/AuthorController.java of the component Cha…
- CVE-2025-3587MEDIUMCVSS 6.3EG 6.32025-04-14
A vulnerability classified as critical was found in ZeroWdd/code-projects studentmanager 1.0. This vulnerability affects unknown code of the file /getTeacherList. The manipulation leads to improper authorization. The attack can be initiate…
- CVE-2025-3569MEDIUMCVSS 6.3EG 6.32025-04-14
A vulnerability was found in JamesZBL/code-projects db-hospital-drug 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file ShiroConfig.java. The manipulation leads to improper authorization. The a…
- CVE-2025-3398MEDIUMCVSS 6.3EG 6.32025-04-08
A vulnerability classified as critical was found in lenve VBlog up to 1.0.0. Affected by this vulnerability is the function configure of the file blogserver/src/main/java/org/sang/config/WebSecurityConfig.java. The manipulation leads to im…
- CVE-2025-3256MEDIUMCVSS 6.3EG 6.32025-04-04
A vulnerability was found in xujiangfei admintwo 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /user/updateSet. The manipulation of the argument email leads to improper access controls…
- CVE-2025-2121MEDIUMCVSS 6.3EG 6.32025-03-09
A vulnerability classified as critical has been found in Thinkware Car Dashcam F800 Pro up to 20250226. Affected is an unknown function of the component File Storage. The manipulation leads to improper access controls. The attack can only …
- CVE-2025-1847MEDIUMCVSS 6.3EG 6.32025-03-03
A vulnerability was found in zj1983 zz up to 2024-8. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been di…
- CVE-2025-0849MEDIUMCVSS 6.3EG 6.32025-01-30
A vulnerability classified as critical has been found in CampCodes School Management Software 1.0. Affected is an unknown function of the file /edit-staff/ of the component Staff Handler. The manipulation leads to improper authorization. I…
- CVE-2025-0783MEDIUMCVSS 6.3EG 6.32025-01-28
A vulnerability, which was classified as problematic, was found in pankajindevops scale up to 20241113. This affects an unknown part of the component API Endpoint. The manipulation leads to improper access controls. It is possible to initi…
- CVE-2024-13211MEDIUMCVSS 6.3EG 6.32025-01-09
A vulnerability was found in SingMR HouseRent 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file src/main/java/com/house/wym/controller/AdminController.java. The manipulation leads to impro…
- CVE-2024-12235MEDIUMCVSS 6.3EG 6.32024-12-05
A vulnerability was found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 1.0.0. It has been declared as critical. Affected by this vulnerability is the function doFilter of the file \agile-bpm-basic-master\ab-auth\ab-auth…
- CVE-2024-11485MEDIUMCVSS 6.3EG 6.32024-11-20
A vulnerability, which was classified as critical, has been found in Code4Berry Decoration Management System 1.0. Affected by this issue is some unknown functionality of the file /decoration/admin/userregister.php of the component User Han…
- CVE-2024-11484MEDIUMCVSS 6.3EG 6.32024-11-20
A vulnerability classified as critical was found in Code4Berry Decoration Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /decoration/admin/update_image.php of the component User Image Handler.…
- CVE-2024-47595MEDIUMCVSS 6.3EG 6.32024-11-12
An attacker who gains local membership to sapsys group could replace local files usually protected by privileged access. On successful exploitation the attacker could cause high impact on confidentiality and integrity of the application.
- CVE-2024-10766MEDIUMCVSS 6.3EG 6.32024-11-04
A vulnerability, which was classified as critical, has been found in Codezips Free Exam Hall Seating Management System 1.0. This issue affects some unknown processing of the file /pages/save_user.php. The manipulation of the argument image…
- CVE-2024-10765MEDIUMCVSS 6.3EG 6.32024-11-04
A vulnerability classified as critical was found in Codezips Online Institute Management System up to 1.0. This vulnerability affects unknown code of the file /profile.php. The manipulation of the argument old_image leads to unrestricted u…
- CVE-2024-10764MEDIUMCVSS 6.3EG 6.32024-11-04
A vulnerability classified as critical has been found in Codezips Online Institute Management System 1.0. This affects an unknown part of the file /pages/save_user.php. The manipulation of the argument image leads to unrestricted upload. I…
- CVE-2024-46540MEDIUMCVSS 6.3EG 6.32024-09-30
A remote code execution (RCE) vulnerability in the component /admin/store.php of Emlog Pro before v2.3.15 allows attackers to use remote file downloads and self-extract fucntions to upload webshells to the target server, thereby obtaining …
- CVE-2024-9082MEDIUMCVSS 6.3EG 6.32024-09-22
A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /classes/Users.php?f=save of the component User Creation Handler. The mani…
- CVE-2024-0085MEDIUMCVSS 6.3EG 6.32024-06-13
NVIDIA vGPU software for Windows and Linux contains a vulnerability where unprivileged users could execute privileged operations on the host. A successful exploit of this vulnerability might lead to data tampering, escalation of privileges…
- CVE-2024-3013MEDIUMCVSS 6.3EG 6.32024-03-28
A flaw has been found in Teledyne FLIR AX8 up to 1.46.16. The impacted element is an unknown function of the file /tools/test_login.php?action=register of the component User Registration. Executing manipulation can lead to improper authori…
- CVE-2024-25083MEDIUMCVSS 6.3EG 6.32024-02-16
An issue was discovered in BeyondTrust Privilege Management for Windows before 24.1. When an low-privileged user initiates a repair, there is an attack vector through which the user is able to execute any program with elevated privileges.
- CVE-2020-36624MEDIUMCVSS 6.3EG 6.32022-12-22
A vulnerability was found in ahorner text-helpers up to 1.0.x. It has been declared as critical. This vulnerability affects unknown code of the file lib/text_helpers/translation.rb. The manipulation of the argument link leads to use of web…
- CVE-2026-1894MEDIUMCVSS 5.4EG 6.32026-02-04
A vulnerability was detected in WeKan up to 8.20. This impacts an unknown function of the file models/checklistItems.js of the component REST API. Performing a manipulation of the argument item.cardId/item.checklistId/card.boardId results …
- CVE-2026-2851MEDIUMCVSS 5.3EG 6.32026-02-20
A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This vulnerability affects the function addInport/updateInport/deleteInport of the file dataset\repos\warehouse\src\main\java\com\yeqifu\bus…
- CVE-2025-13114MEDIUMCVSS 5.3EG 6.32025-11-13
A vulnerability was identified in macrozheng mall-swarm up to 1.0.3. This affects the function updateAttr of the file /cart/update/attr. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploi…
- CVE-2026-2209MEDIUMCVSS 4.3EG 6.32026-02-08
A vulnerability was detected in WeKan up to 8.18. The affected element is the function setCreateTranslation of the file client/components/settings/translationBody.js of the component Custom Translation Handler. The manipulation results in …
- CVE-2025-15106MEDIUMCVSS 4.3EG 6.32025-12-27
A weakness has been identified in getmaxun maxun up to 0.0.28. The affected element is the function router.get of the file server/src/routes/auth.ts of the component Authentication Endpoint. Executing manipulation can lead to improper auth…
- CVE-2025-13118MEDIUMCVSS 4.3EG 6.32025-11-13
A vulnerability was detected in macrozheng mall-swarm up to 1.0.3. Affected by this issue is the function paySuccess of the file /order/paySuccess. The manipulation of the argument orderID results in improper authorization. The attack can …
- CVE-2021-47799MEDIUMCVSS 6.2EG 6.22026-01-15
Visual Tools DVR VX16 version 4.2.28 contains a local privilege escalation vulnerability in its Sudo configuration that allows attackers to gain root access. Attackers can exploit the unsafe Sudo settings by using mount commands to bind a …
- CVE-2022-50927MEDIUMCVSS 6.2EG 6.22026-01-13
Cyclades Serial Console Server 3.3.0 contains a local privilege escalation vulnerability due to overly permissive sudo privileges for the admin user and admin group. Attackers can exploit the default user configuration to gain root access …
Map vulnerabilities like CWE-266 to your infrastructure
EchelonGraph correlates every CVE — across CWE-266 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →