Filtered by CWE-269
Filtered by vendor Subscriptions
Total 2246 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-4335 2025-05-07 8.8 High
The Woocommerce Multiple Addresses plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.7.1. This is due to insufficient restrictions on user meta that can be updated through the save_multiple_shipping_addresses() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.
CVE-2025-3852 2025-05-07 8.8 High
The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.0 to 2.6.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email & password through the update() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
CVE-2025-47420 2025-05-07 N/A
266 vulnerability in Crestron Automate VX allows Privilege Escalation.This issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.
CVE-2022-3419 1 Addify 1 Automatic User Roles Switcher 2025-05-07 6.5 Medium
The Automatic User Roles Switcher WordPress plugin before 1.1.2 does not have authorisation and proper CSRF checks, allowing any authenticated users like subscriber to add any role to themselves, such as administrator
CVE-2022-32907 1 Apple 3 Iphone Os, Tvos, Watchos 2025-05-06 7.8 High
This issue was addressed with improved checks. This issue is fixed in tvOS 16, iOS 16, watchOS 9. An app may be able to execute arbitrary code with kernel privileges.
CVE-2022-32794 1 Apple 2 Mac Os X, Macos 2025-05-06 7.8 High
A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. An app may be able to gain elevated privileges.
CVE-2025-25962 2025-05-06 9.8 Critical
An issue in Coresmartcontracts Uniswap v.3.0 and fixed in v.4.0 allows a remote attacker to escalate privileges via the _modifyPosition function
CVE-2025-3438 1 Inspireui 1 Mstore Api 2025-05-06 6.5 Medium
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 4.17.4. This is due to a lack of restriction of role when registering. This makes it possible for unauthenticated attackers to to register with the 'wcfm_vendor' role, which is a Store Vendor role in the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress. The vulnerability can only be exploited if the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin is installed and activated. The vulnerability was partially patched in version 4.17.3.
CVE-2023-46145 1 Themify 1 Ultra 2025-05-05 8.8 High
Improper Privilege Management vulnerability in Themify Themify Ultra allows Privilege Escalation.This issue affects Themify Ultra: from n/a through 7.3.5.
CVE-2024-38089 1 Microsoft 1 Defender For Iot 2025-05-05 9.1 Critical
Microsoft Defender for IoT Elevation of Privilege Vulnerability
CVE-2024-25847 1 Myprestamodules 2 Product Catalog \(csv\, Excel\) Import, Product Catalog Import For Prestashop 2025-05-05 9.8 Critical
SQL Injection vulnerability in MyPrestaModules "Product Catalog (CSV, Excel) Import" (simpleimportproduct) modules for PrestaShop versions 6.5.0 and before, allows attackers to escalate privileges and obtain sensitive information via Send::__construct() and importProducts::_addDataToDb methods.
CVE-2025-21659 2025-05-04 5.5 Medium
In the Linux kernel, the following vulnerability has been resolved: netdev: prevent accessing NAPI instances from another namespace The NAPI IDs were not fully exposed to user space prior to the netlink API, so they were never namespaced. The netlink API must ensure that at the very least NAPI instance belongs to the same netns as the owner of the genl sock. napi_by_id() can become static now, but it needs to move because of dev_get_by_napi_id().
CVE-2024-26247 1 Microsoft 1 Edge 2025-05-03 4.7 Medium
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVE-2024-26169 1 Microsoft 14 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 11 more 2025-05-03 7.8 High
Windows Error Reporting Service Elevation of Privilege Vulnerability
CVE-2024-29052 1 Microsoft 7 Windows 10 21h2, Windows 10 22h2, Windows 11 21h2 and 4 more 2025-05-03 7.8 High
Windows Storage Elevation of Privilege Vulnerability
CVE-2024-28904 1 Microsoft 1 Windows Server 2022 23h2 2025-05-03 7.8 High
Microsoft Brokering File System Elevation of Privilege Vulnerability
CVE-2024-21324 1 Microsoft 1 Defender For Iot 2025-05-03 7.2 High
Microsoft Defender for IoT Elevation of Privilege Vulnerability
CVE-2024-28905 1 Microsoft 1 Windows Server 2022 23h2 2025-05-03 7.8 High
Microsoft Brokering File System Elevation of Privilege Vulnerability
CVE-2024-30007 1 Microsoft 1 Windows Server 2022 23h2 2025-05-03 8.8 High
Microsoft Brokering File System Elevation of Privilege Vulnerability
CVE-2022-37929 1 Hpe 18 Hf20, Hf20 Firmware, Hf20c and 15 more 2025-05-02 6.7 Medium
Improper Privilege Management vulnerability in Hewlett Packard Enterprise Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary Flash Arrays.