Filtered by CWE-284
Filtered by vendor Subscriptions
Total 5051 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-59273 1 Microsoft 3 Azure, Azure Event Grid, Azure Event Grid System 2026-02-26 7.3 High
Improper access control in Azure Event Grid allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-48983 1 Veeam 2 Backup And Replication, Veeam Backup \& Replication 2026-02-26 10 Critical
A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenticated domain user.
CVE-2025-37155 1 Hpe 1 Arubaos-cx 2026-02-26 7.8 High
A vulnerability in the SSH restricted shell interface of the network management services allows improper access control for authenticated read-only users. If successfully exploited, this vulnerability could allow an attacker with read-only privileges to gain administrator access on the affected system.
CVE-2025-64897 1 Adobe 1 Coldfusion 2026-02-26 5.6 Medium
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability. A low privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized write access potentially resulting in denial of service. Exploitation of this issue requires user interaction.
CVE-2025-64660 1 Microsoft 1 Visual Studio Code 2026-02-26 8 High
Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.
CVE-2023-24489 1 Citrix 1 Sharefile Storage Zones Controller 2026-02-26 9.8 Critical
A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller.
CVE-2023-23752 1 Joomla 1 Joomla\! 2026-02-26 5.3 Medium
An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.
CVE-2023-33071 1 Qualcomm 26 Qca6574, Qca6574 Firmware, Qca6574a and 23 more 2026-02-25 8.4 High
Memory corruption in Automotive OS whenever untrusted apps try to access HAb for graphics functionalities.
CVE-2023-50706 1 Efacec 2 Uc 500e, Uc 500e Firmware 2026-02-25 4.1 Medium
A user without administrator permissions with access to the UC500 windows system could perform a memory dump of the running processes and extract clear credentials or valid session tokens.
CVE-2025-69284 2 Makeplane, Plane 2 Plane, Plane 2026-02-25 4.3 Medium
Plane is an an open-source project management tool. In plane.io, a guest user doesn't have a permission to access https[:]//app[.]plane[.]so/[:]slug/settings. Prior to Plane version 1.2.0, a problem occurs when the `/api/workspaces/:slug/members/` is accessible by guest and able to list of users on a specific workspace that they joined. Since the `display_name` in the response is actually the handler of the email, a malicious guest can still identify admin users' email addresses. Version 1.2.0 fixes this issue.
CVE-2025-65097 2 Romm.app, Rommapp 2 Romm, Romm 2026-02-24 6.5 Medium
RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2, an Authenticated User can delete collections belonging to other users by directly sending a DELETE request to the collection endpoint. No ownership verification is performed before deleting collections. This vulnerability is fixed in 4.4.1 and 4.4.1-beta.2.
CVE-2025-65096 2 Romm.app, Rommapp 2 Romm, Romm 2026-02-24 4.3 Medium
RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2, users can read private collections / smart collections belonging to other users by directly accessing their IDs via API. No ownership verification or checking if the collection is public/private before returning collection data. This vulnerability is fixed in 4.4.1 and 4.4.1-beta.2.
CVE-2025-11853 1 Sismics 1 Teedy 2026-02-24 6.3 Medium
A vulnerability was determined in Sismics Teedy up to 1.11. This affects an unknown function of the file /api/file of the component API Endpoint. Executing a manipulation can lead to improper access controls. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-15262 1 Biggidroid 1 Simple Php Cms 2026-02-24 4.7 Medium
A security flaw has been discovered in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/edit.php of the component Site Logo Handler. Performing a manipulation of the argument image results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
CVE-2025-15141 1 Halo 1 Halo 2026-02-24 3.1 Low
A vulnerability was determined in Halo up to 2.21.10. This issue affects some unknown processing of the file /actuator of the component Configuration Handler. Executing a manipulation can lead to information disclosure. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-15110 1 Jackq 1 Xcms 2026-02-24 4.7 Medium
A vulnerability has been found in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Affected is the function Upload of the file Admin/Home/Controller/ProductImageController.class.php of the component Backend. Such manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2025-13423 1 Campcodes 1 Retro Basketball Shoes Online Store 2026-02-24 4.7 Medium
A flaw has been found in Campcodes Retro Basketball Shoes Online Store 1.0. The impacted element is an unknown function of the file /admin/admin_product.php. Executing a manipulation of the argument product_image can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.
CVE-2025-13411 1 Campcodes 1 Retro Basketball Shoes Online Store 2026-02-24 4.7 Medium
A vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/admin_football.php. Performing a manipulation of the argument product_image results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
CVE-2025-13238 1 Bdtask 1 Flight Booking Software 2026-02-24 6.3 Medium
A weakness has been identified in Bdtask Flight Booking Software 4. Affected by this vulnerability is an unknown functionality of the file /agent/profile/edit of the component Edit Profile Page. This manipulation causes unrestricted upload. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-12862 1 Projectworlds 1 Online Notes Sharing Platform 2026-02-24 6.3 Medium
A vulnerability was identified in projectworlds Online Notes Sharing Platform 1.0. Affected by this issue is some unknown functionality of the file /dashboard/userprofile.php. Such manipulation of the argument image leads to unrestricted upload. The attack may be performed from remote. The exploit is publicly available and might be used.